Gila CMS Cross-Site Scripting Vulnerability (CNVD-2019-36960)

Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in gila-blog and gila-mag in Gila CMS 1.11.4 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

The vulnerability of the Internet Key Exchange Version 1 function in Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense (FTD) software allows a attacker to induce a service failure.

The vulnerability of the Internet Key Exchange Version 1 IKEv1 function in Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense FTD is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to induce service failure through specially...

WordPress avenirsoft-directdownload plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. avenirsoft-directdownload is a download button plugin used in it. A cross-site request forgery vulnerability exists in version 1.0 of...

S-CMS School Building System v1.0 SQL Injection Vulnerability in Background aj*** U_*** Parameter

S-CMS is a content management system CMS based on PHP and MySQL. S-CMS School Building System v1.0 has a SQL injection vulnerability in the background aj U parameter, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2019-15256

A vulnerability in the Internet Key Exchange version 1 IKEv1 feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service DoS...

CVE-2019-8291

Online Store System v1.0 deletefile.php doesn't check to see if a user has administrative rights nor does it check for path traversal...

CVE-2019-8290

Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sentregister.php allowing special characters to be included and an XSS payload to be injected...

UBUNTU-CVE-2019-17069

PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1MSGDISCONNECT message...

Xionghai CMS V1.0 has a file inclusion vulnerability

XIONGHAI CMS is developed by XIONGHAI can be widely used in personal blogs, personal websites, corporate websites, a set of integrated website management system. XIONGHAI CMS V1.0 has a file inclusion vulnerability that can be exploited by attackers to include arbitrary files...

WordPress cysteme-finder plugin code issue vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in the WordPress cysteme-finder plugin prior to version 1.4, which stems fro...

WordPress zx-csv-upload plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in version 1 of the WordPress zx-csv-upload plugin. The vulnerability ste...

WordPress zm-gallery plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in version 1.0 of the WordPress zm-gallery plugin. The vulnerability stem...

CVE-2019-16264

In Escuela de Gestion Publica Plurinacional EGPP Sistema Integrado de Gestion Academica GESAC v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database...

OPENSUSE-SU-2019:2128-1 Security update for srt

srt was updated to version 1.3.4. Security issues fixed: CVE-2019-15784: avoid a potential array overflow. boo1148844 New binary: srt-tunnel srt-multiplexer binary is now a testing application and thus is dropped from our package. This update was imported from the openSUSE:Leap:15.1:Update update...

UBUNTU-CVE-2019-12402

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress...

CVE-2016-10892

The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues...

SQL Injection Vulnerability in the Frontend of Far Autumn Medical Training Enrollment System v1.0

Far Autumn Medical Online Examination System adopts the universal test bank management software, applicable to all levels and types of medical schools and hospitals, the content contains the three basic exams for medical and nursing personnel, title exams, licensing exams, academic exams, trainin...

Information leakage vulnerability in the frontend of Far Autumn Medical Online Exam System v1.0

Far Autumn Medical Online Examination System adopts the universal test bank management software, applicable to all levels and types of medical schools and hospitals, the content contains the three basic exams for medical and nursing personnel, title exams, licensing exams, academic exams, trainin...

PT-2019-11744 · Jenkins · Jenkins Configuration As Code Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Configuration as Code Plugin versions 1.20 and earlier Jenkins Configuration as Code Plugin versions prior to 1.25 Description: The issue concerns the handling of the proxy password in the Jenkins Configuration as Code Plugin...

CVE-2019-1010245

The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The...