CVE-2018-10236

POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data'name' with no restrictions, and this value is written to the FCPATH.$file file...

CVE-2018-10122

QingDao Nature Easy Soft Chanzhi Enterprise Portal System aka chanzhieps pro1.6 allows remote attackers to read arbitrary files via directory traversal sequences in the pathname parameter to www/file.php...

SQL Injection Vulnerability in Website Construction System of Ningxia Hongfeng Network Technology Co.

Ningxia Hongfeng Network Technology Co., Ltd. is Ningxia Yinchuan area specializing in Internet services nature of the enterprise, to provide enterprise website construction, personal website production, 400 telephone for, website revision, website promotion, SEO keyword optimization, e-commerce...

Apple macOS High Sierra APFS Password Truncation Vulnerability

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.APFS is one of the file system components for Apple devices. A security vulnerability exists in the APFS component in Apple macOS High Sierra versions prior to 10.13.4. An attacker could exploit the...

Wenzhou Qiaoyu Technology Co., Ltd. station building system SQL injection vulnerability

Wenzhou Qiaoyu Technology Co., Ltd. is a focus on high-quality website construction, micro-site development, network marketing services SEO optimization as one of the innovative level of the company. Wenzhou Qiaoyu Technology Co., Ltd. website building system SQL injection vulnerability, attacker...

Solaris 10 (x86) : 150833-08

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: UNIX filesystem. Supported versions that are affected are 10 and 11.2. Easily exploitable vulnerability requiring logon to Operating System. Successful attack of this vulnerability can result in unauthorized...

Wowza Streaming Engine File System Read/Write Vulnerability

Wowza Streaming Engine is a Unified Streaming Media Server software developed by Wowza Media Systems. A file system read and write vulnerability exists in Wowza Streaming Engine. An attacker can read and write to the file system via JMX using default JMX credentials remote code execution is also...

Design/Logic Flaw

On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when processing undisclosed types of data on systems with 48 or more CPU cores...

Unspecified Vulnerability in Oracle Hospitality Cruise Fleet Management (CNVD-2018-02359)

Oracle Hospitality Applications is a suite of business applications, servers, and storage solutions for hospitality management from Oracle Corporation. Oracle Hospitality Cruise Fleet Management is one of the fleet management components of Oracle Hospitality Cruise Fleet Management, which provide...

CVE-2018-0748

The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way memory...

CVE-2017-1257

IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 124684...

SQL Injection Vulnerability in Xingtai Dingxin Software Development Co.

Xingtai Dingxin Software Development Co., Ltd. is a supplier, service provider and integrator of information technology management and Internet construction for enterprises and governments. A SQL injection vulnerability exists in the website construction system of Xingtai Dingxin Software...

CVE-2017-16611

In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open but not read files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files...

CVE-2017-8210

The CVE-2017-8210 entry concerns a buffer overflow in the driver of Huawei Honor 5C and Honor 6X smartphones. Affected software versions are earlier than NEM-AL10C00B356 and earlier than Berlin-L21HNC432B360. The root cause is lack of parameter validation in the driver, enabling an attacker to tr...

Repo password on display for the world to see.

I just noticed that my machine user name and password are on display above the commit dialog. Since this job site uses single sign on for everything, that's my username and password for the entire system here. I have three different repos loaded in Sourcetree. Because of single sign on, that is...

Login Bypass Vulnerability in Xinhuo Collaboration Platform

Xinhuo coworking system is an open source office system, cross-platform system, support APP, pc web version, pc client and so on. Xinhao Collaboration Office platform there is a login bypass vulnerability , attackers can use the vulnerability to bypass authentication , successfully logging into t...

Google Android System Elevation of Privilege Vulnerability

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in System for Google Android 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0, which can be exploited by attackers to gain elevation ...

KLA11130 Denial of service vulnerability in Google Chrome

An unspecified vulnerability in the V8 component that allows the stack-based buffer to overflow stack buffer overflow. This vulnerability can be exploited remotely by an unauthenticated attacker to execute arbitrary code and to cause denial of service; Technical details NB: This vulnerability doe...

Wicked gem contains Path traversal vulnerability

The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/renderredirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system...

GHSA-RPRJ-G6XC-P5GQ Wicked gem contains Path traversal vulnerability

The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/renderredirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system...