imcat Information Disclosure Vulnerability

imcat is a PHP-based open source website building system . A security vulnerability exists in imcat version 4.4. Remote attackers can use root/tools/adbug/binfo.php URI to obtain sensitive debugging information...

imcat information disclosure vulnerability (CNVD-2019-00970)

imcat is a PHP-based open source website building system . A security vulnerability exists in imcat version 4.4. Remote attackers can use root/tools/adbug/check.php URI to obtain sensitive configuration information...

imcat Information Disclosure Vulnerability (CNVD-2019-00971)

imcat is a PHP-based open source website building system . A security vulnerability exists in imcat version 4.4. Remote attackers can use root/tools/adbug/binfo.php?phpinfo1 URI to obtain information...

imcat information disclosure vulnerability (CNVD-2019-00972)

imcat is a PHP-based open source website building system . A security vulnerability exists in imcat version 4.4. An attacker can exploit the vulnerability to leak the full path with ev.php?tools-ipaddr&api=Pcoln&uip= URI...

WUZHI CMS SQL Injection Vulnerability (CNVD-2019-03304)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in the coreframe/app/coupon/admin/copyfrom.php file in WUZHI CMS version 4.1.0. A remote attacker can exploit this vulnerabili...

Fastspot BigTree Information Disclosure Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An information disclosure vulnerability exists in the admin/news/ page in Fastspot BigTree version 4.3, which can be exploited by an attacker to obtain path information...

CVE-2018-1000881

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a...

DEBIAN-CVE-2018-19969

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users,...

Xen elevation of privilege vulnerability (CNVD-2019-07942)

Xen is an open source virtual machine monitor developed by the Xen Project. An elevation of privilege vulnerability exists in 4.11.x and earlier versions of Xen on AMD x86 platforms, which stems from the fact that a TLB refresh is sometimes not performed after an IOMMU mapping change, and can be...

ALPINE-CVE-2018-19961

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes...

CVE-2018-17158

In FreeBSD before 11.2-STABLEr340854 and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 request. Unprivileged remote users with access to the NFS server can crash the system by sending a specially crafted NFSv4 request...

CVE-2018-14708

An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic...

ZyXEL NSA325 V2 Cross-Site Request Forgery Vulnerability

The ZyXEL NSA325 V2 is a network storage device from Hopkins ZyXEL Technology. A security vulnerability exists in the web application of the ZyXEL NSA325 V2 version 4.81. The vulnerability can be exploited by an attacker to perform a state change operation using a specially crafted HTTP form...

FreeBSD NFS Server Code Flaw Vulnerability (CNVD-2018-26669)

FreeBSD is a set of Unix-like free operating systems in the FreeBSD project run by the Core Team, and is an important branch of Unix-like operating systems developed through BSD, 386BSD, and 4.4BSD.NFS server is one of the network file system servers. A security vulnerability exists in the NFS...

SQL Injection Vulnerability in ThinkSNS V4

ThinkSNS is an open source social system under Wise Software Beijing Co. ThinkSNS V4 suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in QYKCMS v4.3.2

QYKCMS is a lightweight intelligent website building system based on PHP+MySql developed by QYK. QYKCMS v4.3.2 suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2018-15769

RSA BSAFE Micro Edition Suite versions prior to 4.0.11 in 4.0.x series and versions prior to 4.1.6.2 in 4.1.x series contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service DoS on TLS clients during the handshake when a very large prime value is se...

CVE-2018-6980

VMware vRealize Log Insight 4.7.x before 4.7.1 and 4.6.x before 4.6.2 contains a vulnerability due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which the...

CVE-2018-2479

SAP BusinessObjects Business Intelligence Platform BIWorkspace, versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

keycloak: expiration not validated in SAML broker consumer endpoint

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack...