GHSA-PMV6-GF98-P3R5 Command Injection in kill-port

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input such as the port number is passed directly to the function. Recommendation Upgrad...

CVE-2018-18845

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

PHPSHE XML External Entity Injection Vulnerability

Lingbao Jane Hao Network Technology PHPSHE is an online shopping mall system of China Lingbao Jane Hao Network Technology Company. The system supports express tracking, online chat, order evaluation and statistics and other functions. An XML external entity injection vulnerability exists in Lingb...

Hsycms v1.1 suffers from SQL Injection Vulnerability

Hsycms is an enterprise-level web content management system, written by PHP+MYSQL, using template separation technology to support the creation of many types of sites. Hsycms v1.1 suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database...

CVE-2019-0276

Banking services from SAP 9.0 FSAPPL version 5 and SAP S/4HANA Financial Products Subledger S4FPSL, version 1 performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges...

CVE-2019-9651

An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the checkbad function's filtering is not strict, resulting in PHP code execution. This occurs because some dangerous PHP functions such as "eval" are blocked but others such as "system" are not, and...

WTCMS Denial of Service Vulnerability

WTCMS is a ThinkPHP-based content management system CMS. A denial of service vulnerability exists in WTCMS version 1.0, which can be exploited by remote attackers to cause a denial of service resource consumption with the help of specially sized captcha images...

CVE-2013-5654

Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage...

Code Execution Vulnerability in Ac***.cl***.php in LmxCMS V1.4 Backend

Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name. A code execution vulnerability exists in Ac.cl.php in the backend of LmxCMS V1.4. An attacker can exploit the vulnerability to launch a remote command...

PHPSHE Mall System v1.7 Existing Arbitrary File Read Vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE Mall System v1.7 has an arbitrary file...

GNU Recutils rec-mset.c File Double Release Vulnerability

GNU Recutils is a set of plain text databases from the GNU Project. A double release vulnerability exists in the 'recmesetelemdestroy' function in the rec-mset.c file in GNU Recutils version 1.8. No details of the vulnerability are provided at this time...

SUSE-SU-2019:0061-1 Security update for haproxy

This update for haproxy to version 1.8.15 fixes the following issues: Security issues fixed: - CVE-2018-20102: Fixed an out-of-bounds read in dnsvalidatednsresponse, which allowed for memory disclosure bsc1119368 - CVE-2018-20103: Fixed an infinite recursion via crafted packet allows stack...

PHPSHE mall system v1.7 background SQL injection vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE Mall System v1.7 has a SQL injection...

Stripe API Access Restriction Bypass Vulnerability

Stripe is a set of online payment platforms from Stripe Inc. in the U.S. Stripe API is one of the application program interfaces. An access restriction bypass vulnerability exists in Stripe API version 1, which can be exploited by remote attackers to bypass access restrictions...

S-CMS File Read Vulnerability

S-CMS is a content management system CMS based on PHP and MySQL. A file read vulnerability exists in the admin/download.php file in S-CMS version 1.0, which can be exploited by an attacker to read files with the help of the 'DownName' parameter...

Unauthorized Access Vulnerability in DSCms Enterprise Site Content Management System v1.3

DSCms enterprise station content management system is a enterprise website system launched by Changsha Desha Network Technology Co. DSCms Enterprise Station Content Management System v1.3 has an unauthorized access vulnerability, which can be exploited by attackers to modify other users'...

ARM Trusted Firmware Information Disclosure Vulnerability

ARM Trusted Firmware is an implementation of multiple ARM interface standards. An information disclosure vulnerability exists in ARM Trusted Firmware version 1.4 and earlier, which stems from a program's failure to initialize or save/store the PMCREL0 register and can be exploited by an attacker ...

AbiSoft Ticketly SQL Injection Vulnerability

AbiSoft Ticketly is a PHP and MySQL based ticketing software from AbiSoft in the Republic of Guatemala. A SQL injection vulnerability exists in AbiSoft Ticketly version 1.0, which can be exploited by remote attackers to execute arbitrary SQL commands with the help of multiple parameters...

CVE-2018-2497

The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE AS SELECT...

Code execution vulnerability in zzzcms v1.5.8 backend sa***.php file

zzcms is a free website builder developed in asp language. zzzcms v1.5.8 code execution vulnerability exists in the background sa.php file. An attacker can exploit this vulnerability to execute arbitrary code...