995 matches found
SQL Injection, Arbitrary File Upload Vulnerability in Panavision Standard Edition e-office
Panmicro Office e-office Standard Edition is a work platform for small businesses or teams. SQL injection and arbitrary file upload vulnerabilities exist in Panmicro Standard Edition e-office, allowing attackers to exploit the vulnerabilities to obtain sensitive database information, upload...
Zhongkexinye Network Sentinel Arbitrary File Upload Vulnerability (CNVD-2015-07932)
ZKXY Network Sentinel is an Internet security auditing system that integrates behavioral auditing and content auditing and is deployed at the network exit in a bypass mode. ZKXN Network Sentry suffers from an arbitrary file upload vulnerability. An attacker can exploit the vulnerability to upload...
PuTTY -- memory corruption in terminal emulator's erase character handling
Ben Harris reports: Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a potentially memory-corrupting integer overflow in the handling of the ECH erase characters control sequence in the terminal emulator. To exploit a vulnerability in the terminal emulator, an attacker must be abl...
The vulnerability of the MySQL database management system allows a attacker to gain access to the MySQL Server or execute arbitrary code.
The vulnerability of Client programs, a sub-component of the MySQL database management system, is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating locally, to gain access to the MySQL Server or execute arbitrary code...
The vulnerability of the Squid proxy server allows attackers to bypass existing restrictions and gain access to the server.
The vulnerability of the Squid proxy server is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to bypass existing restrictions and gain access to the server by manipulating the CONNECT request...
jenkins: external entity injection via XPath (SECURITY-165)
It was found that Jenkins' XPath handling allowed XML External Entity XXE expansion. A remote attacker with read access could use this flaw to read arbitrary XML files on the Jenkins server...
How the invasion of the Pocket within the network-vulnerability warning-the black bar safety net
Let's black IT security recently reported, the Pocket application's developers recently fixed a few leaked data a vulnerability, hackers may be from the server, obtain sensitive information. Here offer tutorials for everyone to learn and exchange. The Pocket is what I have many years did not put...
Firefox bookmarks extensions apps Pocket: vulnerability mining not so difficult-vulnerability warning-the black bar safety net
The Pocket application's developers recently fixed a few leaked data a vulnerability, hackers may be from the server to obtain WEB Services, internal IP address, as well as more sensitive information. Pocket profile Pocket formerly known as Read it Later, as the name suggests, is an online...
Arbitrary File Upload Vulnerability in WeChat Service Intelligent Platform of Yue Liang Legend Technology Co.
The main business of EVERLIGHT LEGEND TECHNOLOGY CO., LTD. is industry application software, and the main customers are telecommunication operators, electric power and aviation. WeChat Service Intelligent Platform is one of the operating platforms of Yue Liang Legend Technology Co. A generic...
SugarCRM SuiteCRM 'Upload Company Logo' Arbitrary File Upload Vulnerability
SugarCRM is an open source customer relationship management CRM system from SugarCRM, Inc. in the United States. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales reps.SuiteCRM i...
Hangzhou Boce Network Technology Co., Ltd. station-building system / bocadmin/j/uploadify.php there are arbitrary file upload vulnerability
BOC is a system of Hangzhou Bocai Network Technology Co., Ltd. that provides professional website construction services. The website building system /bocadmin/j/uploadify.php of Hangzhou Bocai Network Technology Co., Ltd. has an arbitrary file upload vulnerability, which allows an attacker to...
CVE-2015-0550
Directory traversal vulnerability in EMC Documentum Thumbnail Server 6.7SP1 before P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P01 allows remote attackers to bypass intended Content Server access restrictions via unspecified vectors...
Directory traversal
Directory traversal vulnerability in EMC Documentum Thumbnail Server 6.7SP1 before P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P01 allows remote attackers to bypass intended Content Server access restrictions via unspecified vectors...
Security update for cups (critical)
This update fixes the following issues: - CVE-2015-1158 and CVE-2015-1159 fixes a possible privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server CUPS STR4609 CERT-VU-810572 CVE-2015-1158 CVE-2015-1159 bugzilla.suse.com bsc924208. In genera...
Bonita BPM Path Traversal Vulnerability
Bonita BPM is an open source business process management - workflow suite. A path traversal vulnerability exists in Bonita BPM. Since the input passed to the "bonita/portal/themeResource" URL via the "theme" and "location" HTTP GET parameters is not properly validated as part of the used filename...
SAP Mobile Platform XXE Information Disclosure Vulnerability (CNVD-2015-02245)
SAP Mobile Platform is an enterprise mobility platform. SAP Mobile Platform suffers from an XXE External Entity Reference vulnerability that allows remote attackers to submit special XML to send requests to an internal server to obtain sensitive information...
CVE-2014-8105
389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors...
Phabricator: Server Side Request Forgery in macro creation
mongoose just getting it out of the way ; Hi, I would like to report a Server Side Request Forgery SSRF 1 in the meme creation section of the phabricator software 2. SSRF is a vulnerability allowing requests to be made from the context of the server. This could allow an attacker to gain access to...
WordPress 3 persistent script injection
OVERVIEW ======== A security flaw in WordPress 3 allows injection of JavaScript into certain text fields. In particular, the problem affects comment boxes on WordPress posts and pages. These don't require authentication by default. The JavaScript injected into a comment is executed when the targe...