CVE-2016-9364

An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access arbitrary files and directories on the server...

Coppermine 1.5.42: Second-Order Command Execution

RIPS Analysis The analysis with RIPS took only 53 seconds to complete and it uncovered a lot of security vulnerabilities - although most of them require authentication. Nonetheless, these issues are severe because they can be combined with other security vulnerabilities that allow an attacker to...

File upload vulnerability in the file /userweb/php/index/daPing.class.php of the Tibus Communications call center system

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. A file upload vulnerability exists in the file /userweb/php/index/daPing.class.php in the Tibco Call Center System. The vulnerability allows an attacker to upload a webshell a...

Adult FriendFinder Vulnerability Leaves Millions Exposed, Report Claims

Adult website Adult FriendFinder may have been compromised by a hacker who said he has gained access to the site’s backend servers and posted allegedly compromised data to his Twitter feed. The breach has not been confirmed by the site’s parent company FriendFinder Networks, which says it is...

Arbitrary File Write Vulnerability in Eurohoo Government System of Shanghai Eurohoo Network Technology Co.

Shanghai Ohuhu Network Technology Co., Ltd. is a service-oriented enterprise integrating Internet software research and development, website operation, e-commerce and IT services. There is an arbitrary file write vulnerability in Shanghai Ohuhu Network Technology Co. The vulnerability allows an...

Insecure Redis Instances at Core of Attacks Against Linux Servers

A recent run of attacks against Linux servers called Fairware has been traced to insecure internet-facing Redis installations that hackers have abused to delete web folders and, in some cases, install malicious code. Redis is an open source tool used by web application developers for the purpose ...

SQL Injection Vulnerability in Remote Rapid Application Access Solution System mxcheckuserMachine.php Page Parameter a of UFIDA Information Technology Ltd.

UFIDA UPC Information Technology Co., Ltd. remote rapid application access solution is to use U8 remote access can be realized instantly access to the company's application systems and enterprise information and simplify the deployment and management of complex computing environment. The product...

Arbitrary File Upload Vulnerability in Jianwen Project Management System

Jianwen project management system is a .net developed cycle management system applied to a variety of engineering projects There is an arbitrary file upload vulnerability in the Jianwen Project Management System: File upload vulnerability address:...

Default Backdoor Vulnerability in s-cms Website Builder System

S-CMS is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station of the product. There is a default backdoor vulnerability in s-cms website builder system. Allow attackers to directly obtain site or server permissions...

xDedic Hacked Servers Market May Be Larger Than Originally Thought

New data anonymously shared with Kaspersky Lab researchers may enlarge the scope of and provide additional context to the hacked RDP servers for sale on the now defunct xDedic marketplace. The underground marketplace was disclosed in a report published last Tuesday describing an eBay-style platfo...

Arbitrary File Upload Vulnerability in New Harvest Technology Creative Portal Information Management System

Creative Portal Management System is a creative information publishing platform applied in the construction of New Harvest Technology. The New Harvest Technology Creative Portal Information Management System has an arbitrary file upload vulnerability that allows attackers to exploit the...

WordPress RobotCPA Plugin Local File Inclusion

An information disclosure vulnerability exists in WordPress RobotCPA Plugin. Successful exploitation of this vulnerability could allow a remote attacker to access the content of files found on the web server...

Arbitrary File Upload Vulnerability in PatrolFlow Multi-service Security Gateway Intelligent Management Platform of Beijing Byzoro Network Technology Co.

PatrolFlow is a multi-service security gateway intelligent management platform of Beijing Byzoro Network Technology Co. An arbitrary file upload vulnerability exists in the PatrolFlow multi-service security gateway intelligent management platform of Beijing Byzoro Network Technology Co. The...

Authentication Bypass

Overview Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows terminal access on the server via a web page, an authentication bypass is essentially remote...

Multiple vulnerabilities in the Nepalese national government's common website building system

Nepal National Government Universal System NGUS is a website builder system. There are multiple vulnerabilities in the NGN Universal System that can be exploited by an attacker to obtain sensitive information from the database, upload a webshell, and gain access to the server...

server: patch operation should use patched object to check admission control

An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to gain additional access to resources such as RAM and disk space...

New Relic: [download.newrelic.com] Access to private directories

When we try to open a private folder http://download.newrelic.com/private/ we get a warning: This directory contains special-access versions of the New Relic agents. If you would like to participate in early access or beta testing programs please contact [email protected] and they will forward...

PayPal remote command execution vulnerability analysis-vulnerability warning-the black bar safety net

2 0 1 5 year 1 2 on, the author in the PayPal of a sub-station in found a to be able to remotely execute arbitrary shell commands java deserialization vulnerability, and can impact PayPal products database. I'll be the bug was submitted to PayPal, and was quickly repaired. Vulnerability details !...

UFIDA PDM system suffers from java deserialization vulnerability

UFIDA PDM system is oriented to manufacturing technology informatization, product as the core, product-related data, process, resource integration and management system. UFIDA PDM system has a java deserialization vulnerability that allows attackers to exploit the vulnerability to execute remote...

SQL Injection, Arbitrary File Upload Vulnerability in Panavision Standard Edition e-office

Panmicro Office e-office Standard Edition is a work platform for small businesses or teams. SQL injection and arbitrary file upload vulnerabilities exist in Panmicro Standard Edition e-office, allowing attackers to exploit the vulnerabilities to obtain sensitive database information, upload...