6118 matches found
BusyBox 1.27.2 suffers from a security restriction bypass vulnerability
BusyBox is a set of applications containing several linux commands and tools maintained by Ukrainian software developer Denis Vlasenko. A security restriction bypass vulnerability exists in BusyBox 1.27.2. An attacker can exploit this vulnerability to bypass security restrictions...
Code Execution Vulnerability in anmi V1.1.0 Frontend
Anmi program is a program that focuses on H5 mobile website/app construction. Code execution vulnerability exists in anmi V1.1.0 frontend. An attacker can exploit the vulnerability to execute commands and gain server privileges...
TOTOLINK A3002RU Cross-Site Scripting Vulnerability (CNVD-2018-24107)
TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the noticegen.htm page of the TOTOLINK A3002RU version 1.0.8. A remote attacker can exploit this vulnerability by modifying the "User phrases button" field to execute...
zzzcms V1.5.7 php official version of the foreground SQL injection vulnerability
zzcms is a free and open source building system, mainly facing the majority of webmasters to use. zzzcms V1.5.7 php official version of the foreground there is a SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...
PointOfSales SQL Injection Vulnerability
PointOfSales is a point of sale system. The system includes features such as inventory management, customer management and performance management. A SQL injection vulnerability exists in PointOfSales version 1.0. A remote attacker can exploit this vulnerability to view, add, modify, or delete...
Bakeshop Inventory System SQL Injection Vulnerability
Bakeshop Inventory System is a bakery inventory management system. A SQL injection vulnerability exists in Bakeshop Inventory System version 1.0. A remote attacker can use the login page to view, add, modify, or delete information in the back-end database...
School Equipment Monitoring System SQL Injection Vulnerability
School Equipment Monitoring System is a school equipment management system. A SQL injection vulnerability exists in School Equipment Monitoring System version 1.0. A remote attacker can use the login page to view, add, modify, or delete information in the back-end database...
CVE-2018-18793
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...
CVE-2018-19145
An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter...
CVE-2018-18887
S-CMS PHP 1.0 has SQL injection in member/membernews.php via the type parameter aka the $Ntype field...
GHSA-P699-3WGC-7H72 org.apache.tika:tika-parsers has an Infinite Loop vulnerability
Versions of the package org.apache.tika:tika-parsers before version 1.18 are vulnerable to Denial of Service DoS via a carefully crafted or fuzzed file that can trigger an infinite loop via the ChmParser...
bouncycastle: BKS-V1 keystore files vulnerable to trivial hash collisions
A flaw involving a risky cryptographic algorithm was found in Bouncycastle. BKS-V1 contained a design flaw resulting from using the SHA-1 hash function, as it contains a 16-bit MAC key size and a 160-bit SHA-1 hash function. This flaw allows an attacker to brute force the password due to the...
Advanced HRM Remote Code Execution Vulnerability
Advanced HRM is a human resource management system. A security vulnerability exists in Advanced HRM version 1.6. A remote attacker can exploit the vulnerability by sending a .php file with PHP code to the user/update-user-avatar URI to execute code...
Core: information disclosure due to authentication information exposed in a redirect
An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0...
SQL Injection Vulnerability in PbootCMS v1.2.1
PbootCMS is a new core open source enterprise building system developed by Avantech. PbootCMS v1.2.1 suffers from SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...
D-Link DIR-816 Command Injection Vulnerability (CNVD-2019-02394)
D-Link DIR-816 is a home router product from AUO. A command injection vulnerability exists in the D-Link DIR-816 A2 version 1.10 B05, which originates from a program that uses HTTP requests to build commands, and can be exploited by an attacker for command injection...
Gxlcms Cross-Site Scripting Vulnerability
Gxlcms is an enterprise website creation system. A cross-site scripting vulnerability exists in Gxlcms version 1.0, which can be exploited by remote attackers to inject arbitrary Web script or HTML by sending PATHINFO to the file gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php...
DEBIAN-CVE-2018-5389
The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline...
DEBIAN-CVE-2018-1000665
Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...