File Upload Vulnerability in YunMOK

YunMOK cloud module is a free website management system launched by Nanchong Tiger Cloud Network Technology Co. A file upload vulnerability exists in YunMOK, which can be exploited by attackers to gain access to the web server...

MyuCMS open source content management system Fo***.php file file upload vulnerability

MyuCMS open source content management system developed using ThinkPHP community mall aggregation, plug-ins, templates, lightweight and fast easy to expand. MyuCMS open source content management system Fo.php file file upload vulnerability . Attackers can use the vulnerability to upload webshell,...

Command Execution Vulnerability in V8+ Terminal Security System of Beijing Kingsoft Security Management System Technology Co.

Kingsoft v8+ Terminal Security System is a new generation of enterprise terminal security software, the product can dynamically detect, real-time processing, network-wide traceability of unknown threats in the user network. Beijing Kingsoft Security Management System Technology Co., Ltd. V8+...

Hard-Coded Key Used For Remember-me Token in Opencast

Impact The security configuration in etc/security/mhdefaultorg.xml enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring th...

Webshell Bypass Vulnerability in Web Security Dog (Apache Edition) (CNVD-2020-12884)

Website Security Dog Apache Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features. Web Security Dog Apache Edition has a webshell bypass vulnerability. Attackers can use the vulnerability to bypass Web...

File upload vulnerability in Up***.php file of Bitter Chrysanthemum OA Office System

Bitter Chrysanthemum OA office system is suitable for small and medium-sized enterprises, general-purpose collaborative OA management software, incorporating Bitter Chrysanthemum OA's rich experience in management software development for a long time and advanced technology, the system adopts the...

Command execution vulnerability in the PHPMyWind si***_sa***.php file

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A command execution vulnerability exists in the PHPMyWind sisa.php file. An attacker can exploit the vulnerability to execute commands and gain server privileges...

File Upload Vulnerability in the Conference Reservation System of Beijing Soomailian Network Technology Co.

Somai is a provider of professional digital signage solutions, Somai products include Rmeeting meeting reservation, information dissemination, visitor system, face recognition access control/gate, advertising machine, touch query machine, intelligent coffee table, interactive system, serving chai...

CVE-2020-5504

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server...

CVE-2020-5504

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server...

Ahsay Systems Cloud Backup Suite Arbitrary File Upload Vulnerability

Ahsay Systems Cloud Backup Suite is a centralized cloud backup solution from Ahsay Systems in Hong Kong, China. The product supports features such as database backup and physical server backup. A security vulnerability exists in Ahsay Systems Cloud Backup Suite version 8.3.0.30. The vulnerability...

Design/Logic Flaw

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file in...

CVE-2020-5846

The CVE-2020-5846 issue affects Ahsay Cloud Backup Suite 8.3.0.30. It describes an insecure file upload via PUT /obs/obm7/file/upload, where a base64-encoded pathname is supplied in the X-RSW-custom-encode-path header and the file contents in the request body. This allows uploading a file into an...

Command Execution Vulnerability in Blue Route Blog System (CNVD-2020-13869)

The Blue Route blog system is a user multi-user collaborative writing blog system. A command execution vulnerability exists in the Blue Route Blog System that can be exploited by an attacker to gain control of a web server...

Webshell Bypass Vulnerability in Website Security Dog APACHE Edition (CNVD-2020-10491)

Website Security Dog is a server security protection software, is for IDC operators, web hosting service providers, enterprise hosts, server administrators and other users to provide server security prevention of the practical system, is a combination of website content security protection, websi...

Webshell Bypass Vulnerability in Website Security Dog APACHE Edition (CNVD-2020-10489)

Website Security Dog is a server security protection software, is for IDC operators, web hosting service providers, enterprise hosts, server administrators and other users to provide server security prevention of the practical system, is a combination of website content security protection, websi...

File Upload Vulnerability in Laike Ecommerce Management System

Laike e-commerce system is an open source e-commerce system. Laike E-commerce Management System suffers from a SQL injection vulnerability that can be exploited by attackers to gain server privileges...

CVE-2019-19341

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRETKEY and the database backup. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every...

File Upload Vulnerability in LJCMS of Beijing Liangjing Zhicheng Technology Co.

LJCMS is a free and open source content management system. A file upload vulnerability exists in LJCMS by Beijing Liangjingzhicheng Technology Co. It allows attackers to upload webshell and gain server privileges...

TPshop open source mall file upload vulnerabilities exist in the foreground

TPshop open source mall is developed with the latest version of ThinkPHP shop mall. TPshop open source mall front-end file upload vulnerability. Allow attackers to upload webshell, get server privileges...