CVE-2018-18422

CVE-2018-18422 affects UsualToolCMS 8.0. The vulnerability is a CSRF flaw that allows an attacker to add a new user via the path cmsadmin/a_adminx.php?x=a. Reported CVSS metrics: CVSS v2 base 6.8 (MEDIUM) and CVSS v3 base 8.8 (HIGH). Root cause: CSRF in the user-creation flow. Impact details are ...

Remote code execution

NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution...

CVE-2018-17892

NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution...

CVE-2018-17892

NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution...

CVE-2018-17892

NUUO CMS (versions 3.1 and prior) contains a vulnerability described as Incorrect Permission Assignment for Critical Resource (CWE-732) that could allow a user account compromise and potentially remote code execution. This CVE is associated with CVE-2018-17892. The issue is documented across mult...

CVE-2018-17892

NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution...

CVE-2018-18215

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account...

CVE-2018-18215

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account...

NUUO NVRmini2 and NVRsolo

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: NUUO Equipment: NVRmini2, NVRsolo Vulnerabilities: Stack-based Buffer Overflow, Leftover Debug Code 2. RISK EVALUATION Successful exploitation of these...

Code injection

A vulnerability has been identified in ROX II All versions V2.12.1. An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network...

CVE-2018-17919

All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams...

CVE-2018-17919

CVE-2018-17919 is supported by connected sources: XMeye P2P Cloud Server devices expose an undocumented user account named “default” with its default password, enabling login to view video streams. Multiple sources (ICSA, CNVD, SEC Consult / PACKETSTORM advisories, CVE listings) confirm this issu...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

Cross site request forgery (csrf)

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-18201

CVE-2018-18201 affects qibosoft V7.0. The connected CNVD/NVD entries describe a Cross-Site Request Forgery (CSRF) vulnerability that can be triggered via the URL pattern: admin/index.php?lfj=member&action=addmember, enabling an attacker to add a user account. The documents do not provide details ...

mod_perl security update

CentOS Errata and Security Advisory CESA-2018:2737 An update for modperl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: rh-perl524-mod_perl security update

An update for rh-perl524-modperl is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess

modperl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting...