CVE-2020-10922

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issu...

Apache Kylin SQL Injection Vulnerability

Apache Kylin is the United States Apache Apache Software Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. A SQL injection vulnerability exists in...

Glacies IceHRM SQL Injection Vulnerability

Glacies IceHRM is a human resource management system from the Glacies team in Germany. The system includes features such as expense management, recruitment management, payroll management and leave management. A SQL injection vulnerability exists in the Admin Reports feature in Glacies IceHRM...

CVE-2020-5970

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of service. This affects vGPU version 8.x prior to 8.4, version 9.x prior to 9.4 and version 10.x prior to 10.3...

WordPress Nexos theme SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Nexos theme is a real estate website theme plugin used in it. WordPress Nexos theme has a SQL injection vulnerability. The...

CVE-2020-15017

NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...

CVE-2020-11520

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution...

Mattermost Server SQL Injection Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A SQL injection vulnerability exists in Mattermost Server, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an attack...

PHP-Fusion SQL Injection Vulnerability (CNVD-2020-52839)

PHP-Fusion is a Malaysian PHP-Fusion company based on MySql and PHP open source lightweight content management system . The system contains modules such as news, articles and forums. A SQL injection vulnerability exists in the administration/comments.php endpoint in PHP-Fusion version 9.03.50. Th...

Jason2605 AdminPanel SQL Injection Vulnerability

Jason2605 AdminPanel is a database administration panel. Jason2605 AdminPanel suffers from a SQL injection vulnerability. The vulnerability stems from a database-based application that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

Wordpress LearnPress SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.LearnPress is a learning management system plugin used in it. A SQL injection vulnerability exists in Wordpress LearnPress...

The vulnerability of the Symfony software platform for developing and managing web applications stems from insufficient validation of input data, allowing attackers to compromise data integrity.

The vulnerability of the Symfony software development and management platform is related to an application error where unvalidated user input is passed as a file. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

Cross-site scripting vulnerability in multiple NETGEAR products (CNVD-2020-26945)

NETGEAR D7800 and others are products of NETGEAR, Inc.NETGEAR D7800 is a wireless modem.NETGEAR R7500 is a wireless router.NETGEAR XR500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless...

ViewVC Cross-Site Scripting Vulnerability (CNVD-2020-33722)

ViewVC is a Web-based CVS, SVN code repository browsing tool . A cross-site scripting vulnerability exists in ViewVC versions prior to 1.1.28 and 1.2.1. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability...

Command Injection

Overview npm-programmatic is a library that allows you to access npm commands programmatically from javascript. Affected versions of this package are vulnerable to Command Injection. The packages and option properties are concatenated together without any validation and are used by the exec...

WordPress StatTraq SQL Injection Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. WordPress StatTraq suffers from a SQL injection vulnerability that stems from the database...

Micro Focus Service Manager Automation SQL Injection Vulnerability

Micro Focus Service Manager is a suite of service desk software from Micro Focus UK. The software supports the deployment of a comprehensive IT service management ITSM system and standardizes management processes. A SQL injection vulnerability exists in Micro Focus SMA. The vulnerability stems fr...

PrestaShop ps_facetedsearch cross-site scripting vulnerability

PrestaShop is a set of open source e-commerce solutions from PrestaShop, USA. The solution provides a variety of payment methods, short message alerts and product image zoom and other features. psfacetedsearch is one of the add layered navigation filter module. A cross-site scripting vulnerabilit...

CVE-2020-10886

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2020-18399)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in Dolibarr ERP/CRM...