CVE-2019-13229

Affected software: deepin-clone up to version 1.1.3. Root cause: Helper::getPartitionSizeInfo writes a log at /tmp/partclone.log and follows symlinks, enabling an unprivileged user to perform a symlink attack to create or overwrite arbitrary filesystem files. Impact: local, unprivileged attacker ...

Unauthorized Access Vulnerability in the Background of Beijing Wen'an Passenger Flow Statistics System

Beijing Wenan Intelligent Technology Co., Ltd. is a company specializing in the research and development of core algorithms and products for artificial intelligence. Unauthorized access vulnerability exists in the background of Beijing Wenan Passenger Flow Statistics System, which can be exploite...

Logic Flaw Vulnerability in JEEWX Jiewei Mail Manager System

JEEWX Jiewei housekeeper system referred to as "Jiewei", is a JAVA-based implementation of the WeChat housekeeper system. A logic flaw exists in the JEEWX system. An attacker can view the source code and obtain sensitive information...

RubyGems Delete directory using symlink when decompressing tar

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files which now include path-checking code for symlinks, it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could...

Google Android System Elevation of Privilege Vulnerability (CNVD-2019-23098)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in the System component of Google Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9. An attacker can exploit the vulnerability to remotely...

SQL Injection Vulnerability in Azeus CMS System 2.0

Azeus CMS is a free CMS system produced by Azeus Studio with comprehensive management features, easy-to-learn operation and high security. Azeus CMS System 2.0 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Together we analyze this just to fix the RDP vulnerability, CVE-2019-0708-vulnerability warning-the black bar safety net

! Write in front of words At Microsoft in May this year of the vulnerability Update Security Bulletin, reference was made to a Remote Desktop Protocol RDP for vulnerabilities. The reason we're here specifically for this vulnerability analysis, is because of this vulnerability the update relates t...

TPshop open source mall system Ap***.php file contains SQL injection vulnerabilities

TPshop open source mall system Thinkphp shop for short , is a set of Shenzhen Soleil Networks Ltd. developed a set of multi- merchant model of the mall system . TPshop open source mall system Ap.php file there is a SQL injection vulnerability , attackers can use this vulnerability to obtain...

EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1552)

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was discovered that the nssfiles backend for the Name Service Switch in glibc would return incorrect data to applications or...

EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1518)

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Linux kernel built with the KVM visualization support CONFIGKVM, with nested visualizationnVMX feature enablednested=1...

Arbitrary file deletion

GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file directory, which may allow an attacker to gain administrative privileges on a system during installation or upgrade...

CVE-2019-3805

A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate a...

Sony Smart TVs Information Disclosure Vulnerability

Sony Smart Tvs are smart TV products from Sony Japan. A log information disclosure vulnerability exists in Sony Smart Tvs. The vulnerability originates from the abnormal output of log files from a networked system or product. An attacker could exploit this vulnerability to obtain sensitive...

USN-3914-2 ntfs-3g update

USN-3914-1 fixed vulnerabilities in NTFS-3G. As an additional hardening measure, this update removes the setuid bit from the ntfs-3g binary. Original advisory details: A heap buffer overflow was discovered in NTFS-3G when executing it with a relative mount point path that is too long. A local...

Code execution vulnerability in HadSky Light Forum system (CNVD-2019-14572)

HadSky Light Forum System is a free and open forum system for individual users. A code execution vulnerability exists in the HadSky Light Forum System, which can be exploited by an attacker to gain control of the web server...

Heilongjiang Yitong Network Technology Development Co., Ltd. website building system has SQL injection vulnerability

Heilongjiang Yitong Network Technology Development Co., Ltd. is an enterprise website building system. There is a SQL injection vulnerability in Heilongjiang Yitong Network Technology Development Co., Ltd. that can be exploited by attackers to obtain sensitive information from the database...

Android Permission License and Access Control Vulnerability (CNVD-2019-09144)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A privilege permission and access control vulnerability exists in System in Android, which arises from a lack of effective privilege permission and access control measures in a networked system o...

Directory Traversal Vulnerability in NetSoft Zhicheng Classifieds Website System

NetSoft Zhicheng classifieds website system is a php mysql based website building system. NetSoft Zhicheng classifieds website system has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information...

RockOA SQL Injection Vulnerability

ROCKOA Xinhuo office system is a free and open source OA collaborative office system for small and medium-sized enterprises. RockOA 1.8.7 SQL injection vulnerability exists. The vulnerability stems from the webmain/webmainAction.php publictreestore method using the pidfields and idfields paramete...

Google Android System Elevation of Privilege Vulnerability (CNVD-2019-23322)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in the System component of Google Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9. An attacker could use this vulnerability to potentiall...