Backend Command Execution Vulnerability

Crossday Discuz! Board abbreviated as Discuz! is a generalized community forum software system launched by Beijing Kangsheng Xinchuang Technology Limited Liability Company. A command execution vulnerability exists in the backend database backup function of Discuz!1.5-2.5 versions. An attacker can...

CVE-2017-8968

A remote execution of arbitrary code vulnerability has been identified in HPE RESTful Interface Tool 1.5, 2.0 hprest-1.5-79.x8664.rpm, ilorest-2.0-403.x8664.rpm. The issue is resolved in iLOREST v2.1 or subsequent versions...

Teradek Cube 7.3.6 CSRF Change Password Exploit

Summary Cube packs world-class video quality into a rugged, portable chassis for quick IP video deployments at any location. Each encoder and decoder includes HDMI and 3G-SDI I/O, Ethernet / WiFI connectivity, and full duplex IFB. Description The application interface allows users to perform...

Security fix for the ALT Linux 8 package jq version 1.5-alt3.M80P.1

1.5-alt3.M80P.1 built June 5, 2018 Anton Farygin in task 207483 May 31, 2018 Anton Farygin - security update fixes: CVE-2016-4074...

CVE-2018-1002100

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

Command injection

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

CVE-2018-1002100

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files...

NexusPHP Cross-Site Request Forgery Vulnerability (CNVD-2018-10475)

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. Multiple cross-site request forgery vulnerabilities exist in NexusPHP version 1.5. A remote attacker can exploit this vulnerability to perform unauthorized operations with the help of 'linkname'...

Teradek Cube 7.3.6 - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications i...

Teradek Cube 7.3.6 - Cross-Site Request Forgery

Teradek Cube 7.3.6 - Cross-Site Request Forgery input type="submit...

SDcms Cross-Site Request Forgery Vulnerability

SDcms is a PHP and MySQL based enterprise building content management system CMS by China Smoke & Fire Network Technology. A cross-site request forgery vulnerability exists in the /WWW//app/admin/controller/admincontroller.php file in SDcms version 1.5. A remote attacker can exploit this...

CVE-2018-11004

An issue was discovered in SDcms v1.5. Cross-site request forgery CSRF vulnerability in /WWW//app/admin/controller/admincontroller.php allows remote attackers to add administrator accounts via m=admin&c=admin&a=add...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08599)

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script ...

Etherpad Arbitrary Code Execution Vulnerability

Etherpad is a Web-based online document collaboration tool. Multiple users can write a text document simultaneously via Etherpad and see real-time edits from all participants. An arbitrary code execution vulnerability exists in Etherpad 1.5.x and 1.6.x before 1.6.4. An attacker can exploit this...

Input validation

If a user of Apache Commons Email typically an application programmer passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details recipients, contents, etc. might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You...

Design/Logic Flaw

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

CVE-2017-1002101

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type including non-privileged pods, subject to file permissions can access files/directories outside of the volume, including the host's filesyste...

CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

CVE-2017-12725

A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establis...