PHPGurukul Online Book Store SQL注入漏洞

PHPGurukul Online Book Store is a PHP-based online bookstore website system. A SQL injection vulnerability exists in Online Book Store v1.0. The vulnerability can be exploited to execute arbitrary code via the bookisbn parameter of adminedit.php...

PHPGurukul Online Book Store SQL注入漏洞

PHPGurukul Online Book Store is a PHP-based online bookstore website system. A SQL injection vulnerability exists in Online Book Store v1.0, which can be exploited by attackers to execute arbitrary code...

PT-2021-3636 · WordPress · Event Banner Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Event Banner WordPress plugin versions prior to 1.4 Description: The issue is related to the lack of verification for uploaded image files, allowing admin accounts to upload arbitrary files, such as .exe or .php, leading to remote code...

MiniCMS 跨站脚本漏洞

MiniCMS is a content management system CMS designed for personal websites. A security vulnerability exists in MiniCMS v1.10 that allows remote attackers to execute arbitrary code by sending a crafted HTTP request injection command to the component "mc-admin post-edit.php"...

CVE-2021-2318

Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway component: Management Console. The supported version that is affected is Prior to 1.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

CVE-2021-2320

Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway component: Management Console. The supported version that is affected is Prior to 1.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

Oracle Cloud Infrastructure Storage Gateway 安全漏洞

Oracle Cloud Infrastructure Storage Gateway is an application gateway from Oracle Corporation in the United States. A security vulnerability in Oracle Cloud Infrastructure Storage Gateway Management Console Prior to 1.4 allows a highly privileged attacker accessed over an HTTP network to compromi...

CASAP Automated Enrollment 跨站脚本漏洞

CASAP Automated Enrollment is an automated enrollment system organized by CASAP USA. The purpose of the project is to provide an automated enrollment system for CASAP to streamline the process for schools and make it more effective, efficient and easily retrievable. A cross-site scripting...

CVE-2021-27130

Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload...

OPENSUSE-SU-2021:0522-1 Security update for fwupd

This update for fwupd fixes the following issues: - Update to version 1.2.14: bsc1182057 - Add SBAT section to EFI images bsc1182057 - CVE-2020-10759: Validate that gpgmeopverifyresult returned at least one signature bsc1172643 This update was imported from the SUSE:SLE-15-SP2:Update update proje...

GHSA-26VR-8J45-3R4W Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Impact When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing CPU resources to eventually reach 100% usage. Workarounds The problem can be worked around by compiling the...

CVE-2020-28173

Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=savesettings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/...

IMAGE CONQUEST DICOM SERVER 命令注入漏洞

IMAGE CONQUEST DICOM SERVER is IMAGE an open source application. It can store, validate, query and retrieve through programmable SQL database tables. A security vulnerability exists in CONQUEST DICOM SERVER before 1.5.0, which can be exploited by attackers to execute malicious code...

INSMA Wifi Mini Spy 1080P HD Security IP Camera 跨站请求伪造漏洞

INSMA Wifi Mini Spy 1080P HD Security IP Camera is a camera from INSMA USA. The INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to access the web via all fields...

HPESBGN04107 rev.2 - HPE iLO Amplifier Pack, Remote Cross-Site Scripting (XSS) Vulnerability

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. iLO Amplifier Pack - Prior to version 1.95 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-26580 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:...

HPESBGN04109 rev.1 - HPE iLO Amplifier Pack, Multiple Remote Cross-Site Scripting (XSS) Vulnerabilities

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. iLO Amplifier Pack - Prior to version 1.80 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-11022 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

Amazon Wireless-N WiFi Repeater 跨站脚本漏洞

Amazon Wireless-N WiFi Repeater is a Singapore Amazon open source wireless WIFI. provides an Internet access feature. A security vulnerability exists in Wireless-N WiFi Repeater REV 1.0 28.08.06.1, which can be exploited by an attacker to steal LAN credentials without connecting to the device...

Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests

A flaw was discovered in Undertow where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from...

CVE-2020-35752

Baby Care System 1.0 is affected by a cross-site scripting XSS vulnerability in the Edit Page tab through the Post title parameter...

libzmq 缓冲区错误漏洞

ZeroMQ libzmq 0MQ is a lightweight distributed messaging engine core library. A security vulnerability exists in libzmq, which can be exploited by an attacker to trigger a denial of service and potentially run code via a buffer overflow via libzmq's ZMTP V1 packet...