DoorGets Arbitrary File Deletion Vulnerability (CNVD-2019-26505)

doorGets is a content management system CMS. The system supports multiple languages, and system backups and theme changes, etc. An arbitrary file deletion vulnerability exists in doorGets version 7.0, which can be exploited by users with background administrator privileges to delete arbitrary fil...

DoorGets Information Disclosure Vulnerability

doorGets is a content management system CMS. The system supports multiple languages, and system backups and theme changes, etc. An information disclosure vulnerability exists in the routers/ajaxRouter.php file in doorGets version 7.0, which can be exploited by an attacker to disclose the physical...

Heap Out-of-Bounds Write Vulnerability in XnView Nconvert v7.25

Nconvert is a cross-platform command-line image processing software in the XnView software family. XnView Nconvert v7.25 suffers from a heap out-of-bounds write vulnerability that can be exploited by an attacker to execute malicious code...

CVE-2019-2039

In rwi93smdetectndef of rwi93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1...

PT-2019-3927 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0.M1 through 9.0.17 Apache Tomcat versions 8.5.0 through 8.5.39 Apache Tomcat versions 7.0.0 through 7.0.93 Description: The issue is related to the CGI Servlet in Apache Tomcat, which is vulnerable to Remote Code...

Apple iCloud for Windows iCloud Installer Code Execution Vulnerability

Apple iCloud for Windows is an American Apple Apple cloud service based on the Windows platform, which supports storage of music, photos, apps, contacts, etc. iCloud Installer is one of the iCloud installer components. A security vulnerability exists in the Windows Installer component in versions...

Drupal cross-site scripting vulnerability (CNVD-2019-12155)

Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal version 7 prior to 7.65, version 8.6 prior to 8.6.13, and version 8.5 prior to 8.5.14, which stems from a lack of proper validation of...

CVE-2019-8997

An XML External Entity Injection XXE vulnerability in the Management System console of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering maliciously crafted XM...

CVE-2019-0275

SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server J2EE-APPS, versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode user-controlled inputs, which results in cross-site scripting XSS vulnerability...

CVE-2019-4038

IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162...

IBM Security Identity Manager Virtual Appliance Information Disclosure Vulnerability (CNVD-2019-07175)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

CVE-2019-6707

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

CVE-2019-6259

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...

OpenSSH Access Restriction Bypass Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. The tools are an open source implementation of the SSH protocol that supports encryption of all transmissions to effectively block eavesdropping, connection...

CVE-2019-5725

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

Vtiger CRM File Upload PHP Code Execution Vulnerability

Vtiger CRM is a customer relationship management software that helps businesses become organized, increase sales, improve marketing ROI and provide an enjoyable customer service experience. A file upload PHP code execution vulnerability exists in Vtiger CRM version 7.1.0 prior to Hotfix2. The...

CVE-2018-1926

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could explo...

OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with...

Qibo CMS station system V7.0 backend file reading vulnerability

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS system V7.0 backend file reading vulnerability exists. The vulnerability is due to the failure of the user to submit a special string of processing , resulting in directory traversal , an attacker can use the vulnerabilit...

SQL injection vulnerability in the background of Qibo CMS V7.0 system

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS system V7.0 backend SQL injection vulnerability exists. Attackers can use the vulnerability to obtain sensitive information...