catfish blog cross-site request forgery vulnerability

Catfish blog is a set of open source blog system developed using the PHP language . A cross-site request forgery vulnerability exists in admin/Index/tiquan in Catfish blog version 2.0.33. A remote attacker can exploit this vulnerability to change the user type...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

Unspecified Vulnerability in Oracle Virtualization VM VirtualBox Component (CNVD-2019-36168)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The solution is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-24458)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the XFA setInterval method in Foxit Reader 9.2.0.9297 and earlier versions and Foxit...

Apache Karaf Security Bypass Vulnerability

Apache Karaf is the United States Apache Apache Software Foundation for the deployment of applications and components of a lightweight OSGi Java Dynamic Modular System container. A security vulnerability exists in Apache Karaf versions prior to 4.2.0. An attacker could exploit the vulnerability t...

PT-2018-2283 · Cisco · Cisco Small Business Routers

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could...

JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

LibreHealthIO LH-EHR Arbitrary File Write Vulnerability (CNVD-2019-21231)

LibreHealthIO LH-EHR is an open source electronic health record and medical practice management application. An arbitrary file write vulnerability exists in the letter.php file in the LibreHealthIO LH-EHR REL-2.0.0 release, which can be exploited to write a file with malicious content and...

PHP Scripts Mall hotel-booking-script Cross-Site Scripting Vulnerability

PHP Scripts Mall hotel-booking-script is a multi-vendor hotel booking script. PHP Scripts Mall hotel-booking-script 2.0.4 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the First Name, Last Name or Address fields...

UBUNTU-CVE-2018-14526

An issue was discovered in rsnsupp/wpa.c in wpasupplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive...

SQL Injection Vulnerabilities in Laoban CMS v2.0

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. SQL injection vulnerability exists in several pages of Laoban CMS v2.0. An attacker can exploit the vulnerability to execute arbitrar...

Pydio Cross-Site Scripting Vulnerability

Pydio formerly known as AjaXplorer is a web-based remote file manager. The manager supports uploading and downloading files, online file editing, image previewing and more. In Pydio 8.2.0 and earlier versions. Line 48 of file /core/vendor/meenie/javascript-packer/example-inline.php and...

CVE-2018-1513

IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Code Execution Vulnerability in LeShang Mall System v2.2.0

LeShang mall system is a based on THINKPHP5.0 as the core development of a free open source professional mall system. Code execution vulnerability exists in LeShang Mall System v2.2.0. An attacker can exploit the vulnerability to write arbitrary files and gain server privileges...

OpenSLP Double Release Vulnerability

OpenSLP Service Location Protocol is an IETF standard protocol developed by the OpenSLP project for dynamic service discovery within the Internet. The protocol supports looking up services in the network by their types and attributes. A double release vulnerability exists in the slpdprocess.c fil...

Unspecified Vulnerability in Pivotal Operations Manager

Pivotal Operations Manager is a Cloud Foundry automated management solution from Pivotal Software, USA. The solution automates the deployment, upgrade and management of the Cloud Foundry platform. A security vulnerability exists in Pivotal Operations Manager versions 2.1.x prior to 2.1.6 and...

CVE-2018-2852

Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications subcomponent: Base. Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Wireshark Denial of Service Vulnerability (CNVD-2018-07444)

Wireshark formerly Ethereal is a suite of network packet analysis software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis.LWAPP dissector is one of the lightweight access point protocol parsers. A security...

CVE-2018-3822

X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacker might have been able to impersonate a legitimate user if the SAML Identity Provider allows for self registration with arbitrary...

JasPer Denial of Service Vulnerability (CNVD-2018-07539)

JasPer is a Canadian software developer Michael Adams developed an open source implementation of the JPEG-2000 codec. A security vulnerability exists in JasPer version 2.0.14. An attacker could exploit this vulnerability to cause a denial of service...