A file inclusion vulnerability exists in the al*** function ma***_tpl parameter of the Qibo blogging system.

Qibo blog system, Qibo software produced by the multi-user blog system. Qibo blog system al function matpl parameter file containment vulnerability, an attacker can exploit the vulnerability contains malicious files, access to server privileges...

D Shield suffers from a webshell bypass vulnerability (CNVD-2020-02213)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability. An attacker can use this vulnerability to bypass the interception of submission...

File upload vulnerability in MyUPB ad***_ic***.php file

MyUPB is a database-free forum that uses text files to store data. A file upload vulnerability exists in the MyUPB adic.php file. This allows an attacker to upload a webshell and gain server privileges...

File Upload Vulnerability in Super CMS Backend

Super CMS Content Management System is a set of products developed to solve the problem of website optimization, it is an open source content management system, the product is based on PHP + MYSQL architecture, and it can run on various platforms such as Windows, Linux, MacOSX, Solaris and so on...

File Upload Vulnerability in Panavision OA Collaboration Office System

Panmicro Collaborative Management Application Platform e-cology is a collaborative business platform with enterprise information portal, knowledge management, data center, workflow management, human resource management, customer and partner management, project management, financial management, an...

CVE-2012-0049

OpenTTD before 1.1.5 contains a Denial of Service slow read attack that prevents users from joining the server...

Webshell bypass vulnerability exists in D Shield (CNVD-2019-43881)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability. An attacker can bypass the D-Shield one-sentence Trojan horse and execute...

XML External Entity (XXE)

checkstyle is vulnerable to XML external entity attacks. External DTDs are not disabled by default, allowing an attacker to inject malicious XML to retrieve system files or submit requests on behalf of the server to gain access to the internal network...

GHSA-J52R-XC68-Q8F4 Insufficiently Protected Credentials in Pivotal Reactor Netty

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...

CVE-2019-2946

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PS. Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

SemCms foreign trade website PHP multilingual version v1.0.4 has file upload vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox, google, 360 and other mainstream browsers. SemCms foreign trade website PHP multilingual version v1.0.4 file upload vulnerability. The...

File Upload Vulnerability in IC Space Management System

The Information Commons is a specially designed one-stop service center and collaborative learning environment that has emerged in the context of the shared learning and open access movement. A file upload vulnerability exists in the IC Space management system, which can be exploited by an attack...

File Upload Vulnerability in Multimedia Management Platform of Beijing Tecbeth Technology Co.

Ltd. is a B2B e-commerce platform for digital products, pioneering the information service model. A file upload vulnerability exists in the multimedia management platform of Beijing Tekbest Technology Co. The vulnerability allows an attacker to upload a webshell and gain server privileges...

Vulnerability of the Server component: The “libmysqld” component of the MySQL Server database management system, which allows attackers to disclose sensitive information.

The vulnerability of the Server component, “libmysqld” of the MySQL Server database management system, is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to disclose sensitive information...

File Upload Vulnerability in the Frontend of Nanjing Benan's Hidden Trouble Detection and Management Information System for Work Safety Accidents v2.3

Nanjing Benan Instrumentation Systems Co., Ltd. is committed to the design and development of hardware and software products in the field of safety production. There is a file upload vulnerability in the frontend of Nanjing Benan's Hidden Trouble Identification and Management Information System...

CVE-2019-15949

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile profile.php?cmd=download, is executed as root via a...

Arbitrary File Deletion and Directory Traversal Vulnerabilities in HongCMS

HongCMS Chinese and English website system is a lightweight website system with extremely fast access speed and easy to use. HongCMS arbitrary file deletion and directory traversal vulnerability, an attacker can use the directory traversal vulnerability can be used with the code execution...

CVE-2019-15642

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Hostinger Data Breach: 14M Customer Passwords, Personal Data at Risk

Web hosting company Hostinger is warning that a breach of one of its servers potentially gave bad actors access to the hashed passwords and personal data of more than 14 million customers. Hostinger, a popular web, cloud and virtual private server hosting provider and domain registrar with 29...

The vulnerabilities in the modules src/User.cpp, src/znc.cpp, and src/IRCNetwork.cpp, which are responsible for disabling clients from connecting to the IRC server or the selected channel, allow a malicious actor to cause service failures.

The vulnerabilities in the modules src/User.cpp, src/znc.cpp, and src/IRCNetwork.cpp, which allow for disabling clients from connecting to the IRC server or the selected channel, exist due to insufficient validation of input data. Exploiting these vulnerabilities could enable a malicious actor to...