CVE-2016-10947: Improper Neutralization of Special Elements used in an SQL Command

The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin...

PT-2019-7740

Name of the Vulnerable Software and Affected Versions The Post Indexer plugin versions prior to 3.0.6.2 for WordPress Description The issue concerns SQL injection via the period parameter, which can be exploited by a super admin. Recommendations For versions prior to 3.0.6.2, update to version...

LimeSurvey Cross-Site Scripting Vulnerability (CNVD-2019-31351)

limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A stored cross-site scripting vulnerability exists in versions prior to Limesurvey 3.17.14. An attacker can exploit this vulnerability to...

Nintendo: [3DS][StreetPass] Buffer Overflow in Super Mario Maker level decompression

-- Information - Platform: New Nintendo 3DS - Region: EU all regions are affected - System version: less or equal to 11.10 latest Description Since the bootroms have been dumped, it is now possible for an attacker to decrypt streetpass communications. Super Mario Maker is vulnerable to a buffer...

Attacking the Intel Secure Enclave

Interesting paper by Michael Schwarz, Samuel Weiser, Daniel Gruss. The upshot is that both Intel and AMD have assumed that trusted enclaves will run only trustworthy code. Of course, that's not true. And there are no security mechanisms that can deal with malicious enclaves, because the designers...

DEBIAN-CVE-2018-20976

An issue was discovered in fs/xfs/xfssuper.c in the Linux kernel before 4.18. A use after free exists, related to xfsfsfillsuper failure...

DRUPAL-CONTRIB-2019-062

This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field. The vulnerability is mitigated by the fact it can only be exploited by a user wi...

Super Login - Moderately critical - Cross site scripting - SA-CONTRIB-2019-062

This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field. The vulnerability is mitigated by the fact it can only be exploited by a user wi...

PT-2019-20533

This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field. The vulnerability is mitigated by the fact it can only be exploited by a user wi...

CVE-2019-13131

Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...

Design/Logic Flaw

Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...

CVE-2019-13131

Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...

CVE-2019-13131

Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...

CVE-2019-13131

CVE-2019-13131 affects Super Micro SuperDoctor 5. The issue arises when restrictions in agent.cfg are not implemented, allowing remote attackers to execute arbitrary commands via NRPE. Multiple connected records (NVD, Red Hat, CNVD, CVE listings, etc.) confirm the same description and classify th...

CVE-2019-13131: Missing Authentication for Critical Function

Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...

PT-2019-13145

Name of the Vulnerable Software and Affected Versions Super Micro SuperDoctor 5 affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via NRPE when restrictions are not implemented in agent.cfg. Recommendations For Super Micro SuperDoctor 5,...

Improper access control

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

CVE-2018-14885

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

CVE-2018-14885

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...

SuperDoctor5 - NRPE Remote Code Execution

SuperDoctor5 - NRPE Remote Code Execution SuperMicro implemented a Remote Command Execution plugin in their implementation of NRPE in SuperDocter 5, which is their monitoring utility for SuperMicro chassis'. This is an intended feature but leaves the system open by default to unauthenticated remo...