SQL Injection Vulnerability in Qibo CMS V7.0 Background

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS V7.0 SQL injection vulnerability exists in the background. Attackers can use the vulnerability to obtain sensitive information in the database...

CVE-2018-1928

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119...

SonarSource SonarQube Information Disclosure Vulnerability

SonarSource SonarQube is an open source code quality management platform from SonarSource Switzerland. The platform can detect code quality from seven dimensions , as well as through the form of plug-ins to support a variety of programming languages , including java, C, C/C++ and other code quali...

CVE-2018-1584

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143497...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-24264)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

PHP Denial of Service Vulnerability (CNVD-2019-00335)

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language is mainly used for Web development and supports a variety of databases and operating systems. A security vulnerability exists in th...

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite and SIMATIC IT UA Discrete Manufacturing License Issue Vulnerabilities

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite, and SIMATIC IT UA Discrete Manufacturing are products of Siemens, Germany.Siemens SIMATIC IT LMS is a line monitoring system for overall equipment effectiveness OEE. Siemens SIMATIC IT LMS is a line monitoring system for Overall Equipment...

CVE-2018-18776

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the admin/admin.asp ShowAll parameter. NOTE: this is a deprecated product...

CVE-2018-18777

Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" in the parameter subpage allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application...

CVE-2018-18775

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product...

CVE-2018-18869

EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter...

DESTOON B2B Cross-Site Scripting Vulnerability (CNVD-2018-21497)

DESTOON B2B is a PHP and MySQL based on open source B2B e-commerce website management system . A cross-site scripting vulnerability exists in the admin/category.inc.php file in DESTOON B2B version 7.0. A remote attacker can inject arbitrary Web script or HTML by providing the 'categorycatname'...

DESTOON B2B Cross-Site Scripting Vulnerability (CNVD-2018-21499)

DESTOON B2B is a PHP and MySQL based on open source B2B e-commerce website management system . A cross-site scripting vulnerability exists in DESTOON B2B version 7.0. Remote attackers can use the admin.php?moduleid=2&action=add URI text box to inject arbitrary Web script or HTML...

DESTOON B2B Cross-Site Scripting Vulnerability

DESTOON B2B is a PHP and MySQL based on open source B2B e-commerce website management system . A cross-site scripting vulnerability exists in the admin\setting.inc.php page in DESTOON B2B version 7.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

GHSA-46J3-R4PJ-4835 The host name verification missing in Apache Tomcat

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88...

CVE-2018-7076

A remote code execution vulnerability was identified in HPE Intelligent Management Center iMC prior to iMC PLAT 7.3 E0605P04...

CVE-2018-18430

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

qibosoft Cross-Site Request Forgery Vulnerability

qibosoft is a content management system of China Qibo Software qibosoft Company. A cross-site request forgery vulnerability exists in qibosoft version 7.0. A remote attacker can add a user account using admin/index.php?lfj=member&action=addmember to exploit this vulnerability...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

UBUNTU-CVE-2018-18025

In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file...