CScms Remote Code Execution Vulnerability

CScms is a content management system CMS developed on a CI framework. A security vulnerability exists in CScms version 4.1. A remote attacker can exploit the vulnerability to execute code...

Cybozu Garoon vulnerable to directory traversal

Overview Cybozu Garoon provided by Cybozu, Inc. contains a directory traversal vulnerability CWE-22 due to a flaw in processing of the session information. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated und...

Ice Qube Thermal Management Center Information Disclosure Vulnerability

Ice Qube Thermal Management Center is a thermal management application from Ice Qube USA. The program includes features such as email notifications, remote management, LCD display and temperature alarms. An information disclosure vulnerability exists in Ice Qube Thermal Management Center versions...

CVE-2018-15483

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04...

CVE-2018-16663

An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parserelations in os/storage/antelope/aql-parser.c while parsing AQL storage of relations...

Dell EMC RSA BSAFE Micro Edition Suite Integer Overflow Vulnerability

Dell EMC RSA BSAFE Micro Edition Suite MES is an encryption toolkit from Dell USA. The toolkit can help developers achieve stable and secure application design. An integer overflow vulnerability exists in Dell EMC RSA BSAFE MES version 4.1.6. A remote attacker could exploit this vulnerability to...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-09139)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS 4.1.0 there is a cross-site scripting vulnerability, attackers can use the vulnerability through the index.php?m=link&f=index&v=add formmark parameter to carry out cross-site...

PT-2018-3976 · Xpdf +2 · Xpdf +2

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.00 Description: The issue is related to errors in the code of the Xpdf software, specifically in the XRef::fetch function in XRef.cc. It allows remote attackers to cause a denial of service, which is a stack consumption, via a...

CVE-2018-16142

PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/logincontrol.php via the back parameter to the okf function...

SAP BusinessObjects Business Intelligence Platform Admin Tools Information Disclosure Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product features report generation, analysis, data visualization, etc. Admin Tools is one of the management tools. An information disclosure...

UBUNTU-CVE-2018-10938

A flaw was found in the Linux kernel present since v4.0-rc1 and through v4.13-rc4. A crafted network packet sent remotely by an attacker may force the kernel to enter an infinite loop in the cipsov4optptr function in net/ipv4/cipsoipv4.c leading to a denial-of-service. A certain non-default...

Atlassian Fisheye and Crucible Cross-Site Scripting Vulnerabilities (CNVD-2018-17876)

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in Atlassian Fisheye and Crucible versions...

Unauthorized Access Vulnerability in txjcms v4.0

Skywalker Networks is an Internet integrated service platform provider. An unauthorized access vulnerability exists in txjcms v4.0. An attacker can exploit this vulnerability to gain control of the web server...

CVE-2018-15187

PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php...

HPE Network Function Virtualization Director Information Disclosure Vulnerability

HPE Network Function Virtualization Director NFVD is a suite of NFV orchestration solutions from Hewlett Packard Enterprise HPE, USA. It is designed to automate the management of end-to-end services across VNFs, VNF forwarding maps, and network services NS. An information disclosure vulnerability...

Charles Proxy Local Elevation of Privilege Vulnerability

Charles Proxy is an HTTP monitor that looks at all HTTP traffic between your computer and the Intel. A local elevation of privilege vulnerability exists in the Charles Proxy Settings suid binary in versions of Charles Proxy prior to 4.2.1. A local attacker can exploit this vulnerability to gain...

Subrion cross-site scripting vulnerability (CNVD-2018-14782)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in uploads/.htaccess in Subrion CMS version 4.2.1, which stems...

File Upload Vulnerability in CSCMS

CSCMS is a multi-functional network information management system developed by Chongsheng Network Technology, which uses PHP5+MYSQL as the technical basis for development. Using OOP object-oriented approach to build the basic operating framework. CSCMS v4.1 RELEASE 20170605 version of the file...

libgig heap buffer overflow vulnerability (CNVD-2018-15174)

libgig is a C++ library for loading, modifying existing and creating new Gigasampler .gig files and DLS downloadable sound level 1/2 files, KORG sample-based instruments .KSF and .KMP files, SoundFont v2 .sf2 files and AKAI sampler data. A heap-based buffer overflow vulnerability exists in the...

PT-2018-12556 · Wuzhi · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: A persistent XSS issue allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the "index.php?m=core&f=set&v=sendmail" API endpoint. The XSS payload is triggered wh...