Shanxi Shanda Xinwang Technology Co., Ltd. customer self-management system there is a universal password login vulnerability

Shanxi Shanda New Network Technology Co., Ltd. is a high-tech company specializing in the development of industry application software products, software services, the company has long been committed to providing enterprise management software with independent intellectual property rights,...

SQL Injection Vulnerability in Shield Spirit Voting Sucker System (CNVD-2020-62877)

Shield Spirit Voting Powder Sucking System can be applied to the public number, through the WeChat public number of the message interface to collect the user to send the vote number of the data to reach the vote, with anti-brush voting voting function, but also efficiently suck the live powder...

CVE-2020-4723

IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

Memory corruption

IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

CVE-2020-16901

An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information t...

UBUNTU-CVE-2020-6104

An exploitable information disclosure vulnerability exists in the getdnodeofdata functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause information disclosure resulting in a information disclosure. An attacker can provide a malicious file to trigger this...

CVE-2020-25859

CVE-2020-25859 concerns the QCMAP_CLI utility in Qualcomm QCMAP, where handling SetGatewayUrl() can invoke system() without input validation. This allows a local attacker with shell access to pass shell metacharacters and execute arbitrary commands. If QCMAP_CLI runs with sudo or setuid, privileg...

Design/Logic Flaw

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

CVE-2020-4689

CVE-2020-4689 affects IBM Security Guardium 11.2 and is a CVS Injection flaw caused by improper validation of CSV file contents. Remote privileged attackers could execute arbitrary commands on the system. CVSS v3.1 base score 6.8 (MEDIUM) with high impact on confidentiality, integrity, and availa...

CVE-2020-4302

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

The vulnerability of the JunOS operating system, related to synchronization errors when using shared resources, allows a hacker to alter the device’s configuration.

The vulnerability of the JunOS operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to modify the device’s configuration...

CVE-2020-25601

An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchnreset / evtchndestroy. In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these when resetting all event channels or when cleaning...

The vulnerability of the PAN-OS operating system, related to copying buffers without checking the size of the input data, allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the PAN-OS operating system lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

Command Execution Vulnerability in Smart-MDS Multimedia Command and Dispatch System of Dixin Technology (CNVD-2020-60313)

But the new technology Smart-MDS multimedia command and scheduling system with convergence access function, provide multi-service convergence of the unified scheduling management platform, access to mainstream various types of audio and video communication system functions. Smart-MDS Multimedia...

GHSA-V86X-F47Q-F7F4 Unauthorized File Access in atompm

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...

Remote code execution

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface GDI handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or dele...

Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63327)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. Microsoft Windows/Windows Server is vulnerable to an information disclosure vulnerability that originates...

CVE-2020-2037

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1...

WMCMS open source novel system V4.367.977 exists arbitrary file reading vulnerability

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS open source novel system V4.367.977 arbitrary file reading vulnerability , attackers can use the vulnerability to obtain sensitive information...

SQL Injection Vulnerability in BaiLian Mall System

BaiLian mall system is a set of computer version of the mall + mobile version of the website + micro mall enterprise wechat public number secondary development + palm sales through the mobile mall + BaiLian bearing network www.bearing.cn the whole network of promotion and publicity in one of the...