NiuShop Single Merchant V4 Arbitrary File Deletion Vulnerability

NiuShop single merchant V4 system is a PHP open source mall system designed and developed by the mountain Hai Niu Zhi Yun Network Technology Co. NiuShop Single Merchant V4 has an arbitrary file deletion vulnerability that can be exploited by attackers to delete system files...

CASAP Automated Enrollment 跨站脚本漏洞

CASAP Automated Enrollment is an automated enrollment system organized by CASAP in the United States. The purpose of the project is to provide an automated enrollment system for CASAP to streamline the process for schools and make it more effective, efficient and easily retrievable. A cross-site...

CVE-2021-1335 Cisco Small Business RV Series Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. These vulnerabilities are due t...

Google Android heap buffer overflow vulnerability (CNVD-2021-14809)

Google Android is a Linux-based open source operating system developed by Google and the Open Handheld Consortium Google. Google Android 11 suffers from a buffer overflow vulnerability that originates from memory corruption in ksd due to a heap buffer overflow. An attacker can exploit the...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple for Mac computers. An arbitrary file read vulnerability exists in Apple macOS, which arises from an application not properly applying security restrictions within the APFS component of macOS. A local user can read arbitrary files on...

Google Android System elevation of privilege vulnerability (CNVD-2021-13689)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An elevation of privilege vulnerability exists in the System component of Google Android 8.1, 9, 10, and 11. An attacker can exploit the vulnerability to potentiall...

Google Android 安全漏洞

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An elevation of privilege vulnerability exists in the System component of Google Android 8.1, 9, 10, and 11. An attacker could exploit this vulnerability to cause a...

BigProf Online Invoicing System 跨站脚本漏洞

BigProf Online Invoicing System OIS is an online invoicing system. A cross-site scripting vulnerability exists in Online Invoicing System OIS version 4.0, which can be exploited by an attacker to take over an administrative account by extracting a csrf token and sending a password change request,...

Google Chrome File System API Policy Enforcement Deficiency Vulnerability (CNVD-2021-28289)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A file system API policy enforcement deficiency vulnerability exists in versions of Google Chrome prior to 88.0.4324.96. A remote attacker can bypass file system...

The vulnerability of the QES operating system, related to access control deficiencies, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the QES operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

CVE-2020-17518

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or...

IBM Cloud Pak System 跨站脚本漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A cross-site scripting vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web UI that could...

Hardcoded credentials

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system...

Apache Kylin Remote Code Execution (CVE-2020-1956)

A command execution vulnerability exists in Apache kylin 2.3.2. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Information disclosure

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

Design/Logic Flaw

Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password...

Security Bulletin: A security vulnerability in Node.js jison affects IBM Cloud Pak for Multicloud Management Managed Service.

Summary A security vulnerability in Node.js jison affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2020-8178 DESCRIPTION: Node.js jison could allow a remote attacker to execute arbitrary commands on the system, caused by insufficient input...

CVE-2019-7198

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS...

BookStack Injection Vulnerability

BookStack is an open source platform for building wiki documentation using PHP and Laravel from the BookStackApp Bookstackapp team. BookStack suffers from a security vulnerability that stems from the fact that in BookStack prior to version 0.30.5, users with edit page permissions could set up the...

CVE-2020-28935

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for...