Code Execution Vulnerability in LmxCMS V1.4

Dream cms lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design mode. A code execution vulnerability exists in LmxCMS V1.4, which can be exploited by attackers to gain server privileges...

Niushop B2B2C Multi-merchant Mall System Exploits Arbitrary Password Reset Vulnerability

NiuShop B2B2C Multi-Merchant Mall System is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. Niushop B2B2C Multi-merchant Mall System V1.11 version of the arbitrary password reset vulnerability, an attacker can use the...

SQL Injection Vulnerability in the Backend of Kewe Polymerization Navigation System v1.7

Kewe Polymerization Navigation System is a full-featured web site navigation system made with PHP+MYSQL. A SQL injection vulnerability exists in the backend of Kovi Convergent Navigation v1.7. A remote attacker can exploit this vulnerability to obtain sensitive database information...

CVE-2018-18802

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/modusers/controller.php?action=edit...

PHPSHE Mall System v1.7 Exists Arbitrary File Deletion Vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. PHPSHE Mall System v1.7 exists arbitrary file...

UBUNTU-CVE-2019-10155

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects...

Arbitrary code execution vulnerability in zzzphp v1.6.6 backend (CNVD-2019-17280)

zzphp is a free website building system developed using PHP. A code execution vulnerability exists in the backend of zzzphp V1.6.6, which can be exploited by attackers to gain control of the web server...

CVE-2019-5955

CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access an arbitrary website via vulnerable application and conduct phishing attacks...

MiniUPnP MiniSSDPd Resource Management Error Vulnerability

MiniSSDPd is a daemon for managing SSDPs on Posix systems. A resource management error vulnerability exists in the 'updateDevice' function of the minissdpd.c file in MiniUPnP MiniSSDPd versions 1.4 and 1.5. The vulnerability stems from the mismanagement of system resources e.g., memory, disk spac...

Bloop Airmail GPG-PGP Plugin Data Forgery Issue Vulnerability

Bloop Airmail is an email application from Bloop Italy.GPG-PGP Plugin is one of the encryption components. A data forgery issue vulnerability exists in Bloop Airmail GPG-PGP Plugin 1.0 9 and prior versions, which arises from a networked system or product that does not adequately validate the orig...

httpd: mod_ssl: access control bypass when using per-location client certification authentication

A flaw was found in Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38. A bug in modssl, when using per-location client certificate verification with TLSv1.3, allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. An attacker could perform vario...

Clever saml2-js authorization issue vulnerability

Clever saml2-js is a SAML Security Assertion Markup Language script used in Clever products. An authentication bypass vulnerability exists in Clever saml2-js versions 2.0 and 1.0. An attacker can use this vulnerability to bypass the authentication mechanism and perform unauthorized operations...

SQL Injection Vulnerability in phpshe v1.7 (CNVD-2019-12520)

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. phpshe v1.7 version of the existence of SQL...

CVE-2019-10951

Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validatio...

CVE-2018-4051

An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally create directories and subdirectories on the root file system, as well as change the permissions of existing directories...

FlatCore Arbitrary File Upload Vulnerability

flatCore is a lightweight content management system CMS based on PHP and SQLite. A security vulnerability exists in the acp/acp.php file in flatCore version 1.4.7. No details of the vulnerability are provided at this time...

Exploit for CVE-2017-0144

Based on the provided code and analysis, here is a summary of the findings: Classification: The repository is an offensive tool for exploiting vulnerabilities, specifically targeting the Windows operating system. Primary Target: The primary target is the Windows operating system, with a focus on...

GHSA-PMV6-GF98-P3R5 Command Injection in kill-port

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input such as the port number is passed directly to the function. Recommendation Upgrad...

CVE-2018-18845

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

PHPSHE XML External Entity Injection Vulnerability

Lingbao Jane Hao Network Technology PHPSHE is an online shopping mall system of China Lingbao Jane Hao Network Technology Company. The system supports express tracking, online chat, order evaluation and statistics and other functions. An XML external entity injection vulnerability exists in Lingb...