Battelle V2I Hub SQL Injection Vulnerability (CNVD-2019-03267)

The Battelle V2I Hub is a connected vehicle and roadway information management system from Battelle Memorial Institute, Inc. The system supports effective communication between infrastructure information and vehicle information. A SQL injection vulnerability exists in Battelle V2I Hub version 3.0...

PT-2018-15402 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 3.0 Description: An issue in S-CMS allows SQL Injection via the P no field in the "bank/callback1.php" API endpoint. Recommendations: For S-CMS version 3.0, update to a version that includes a fix for this issue, or as a tempora...

CVE-2018-1749

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484...

Apache Pluto Information Disclosure Vulnerability

Apache Pluto is the United States Apache Apache Software Foundation set of Portlet container runtime environment. An information disclosure vulnerability exists in the PortletV3AnnotatedDemo Multipart Portlet war file code in Apache Pluto version 3.0.0, which stems from the program's failure to...

express-restify-mongoose information disclosure vulnerability

express-restify-mongoose is a tool for creating interfaces for Mongoose Model. A security vulnerability exists in express-restify-mongoose version 2.4.2 and earlier and versions 3.0.X through 3.0.1. An attacker can exploit the vulnerability by sending a request to obtain the passwords of all user...

HongCMS Cross-Site Scripting Vulnerability

HongCMS is an open source lightweight content management system CMS. A cross-site scripting vulnerability exists in the Add News feature in HongCMS version 3.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of a content field...

Code execution vulnerability in weiPHP

WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. A code execution vulnerability exists in weiPHP versions 3.0 and 4.0, which can be exploited by attackers to gain control of a web server...

Electrum Python Console Bitcoin Theft Vulnerability

Electrum is a lightweight bitcoin client software. python console is one of the python console programs. A security vulnerability exists in the Python console in Electrum versions 2.9.4 and earlier and versions 3.x through 3.0.5. An attacker can exploit this vulnerability to steal bitcoins with t...

gps-server.net GPS Tracking Software (self hosted) Remote Code Execution Vulnerability

gps-server.net GPS Tracking Software self hosted is a GPS location tracking program. The program is able to manage tracking history, reports, events, notifications and more. A security vulnerability exists in the 'writeLog' function in the fncommon.php file in gps-server.net GPS Tracking Software...

Pragyan CMS SQL Injection Vulnerability (CNVD-2017-34577)

Pragyan CMS is a multi-user, modular PHP and MySQL based Content Management System CMS. The system supports custom built-in frameworks, user group rights management, search engine optimization and more. A SQL injection vulnerability exists in Pragyan CMS version 3.0. A remote attacker can exploit...

Pragyan CMS SQL Injection Vulnerability (CNVD-2017-32462)

Pragyan CMS is a multi-user, modular PHP and MySQL based Content Management System CMS. The system supports custom built-in frameworks, user group rights management, search engine optimization and more. A SQL injection vulnerability exists in Pragyan CMS version 3.0. A remote attacker can exploit...

CVE-2017-9593

The "Oculina Mobile Banking" by Oculina Bank app 3.0.0 -- aka oculina-mobile-banking/id867025690 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9024

Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor SCA 3.0, has a Directory Traversal issue in its TFTP Server, allowing attackers to read arbitrary files via ../ sequences in a pathname...

Red Hat OpenShift Enterprise Remote Denial of Service Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. A remote denial of service vulnerability exists in Red Hat OpenShift Enterprise...

Stored Cross-Site Scripting Vulnerability in 50CMS V3.0

50CMS is an open source content management system for software developers, program enthusiasts, and web designers. A stored cross-site scripting vulnerability exists in 50CMS V3.0. Due to the lack of security filtering of form inputs, an attacker can exploit the vulnerability to write arbitrary...

LOCKON EC-CUBE Cross-Site Request Forgery Vulnerability (CNVD-2016-02684)

LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. A cross-site request forgery vulnerability exists in LOCKON EC-CUBE versions 3.0.0 through 3.0.9. An attacker can...

LOCKON EC-CUBE Access Privilege Vulnerability (CNVD-2016-02686)

LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. An access privilege vulnerability exists in LOCKON EC-CUBE versions 3.0.0 through 3.0.9. A remote attacker can exploi...

PHPBack SQL Injection Vulnerability

PHPback is an open source web application feedback system that provides users with feedback on issues and suggestions to help improve the site. A SQL injection vulnerability exists in the 'orderby' parameter in PHPBack version 3.0. Allow attackers to exploit the vulnerability to modify the conten...

Microsoft Active Directory Federated Authentication Service Denial of Service Vulnerability

Microsoft Windows is a family of operating systems released by Microsoft Corporation in the U.S. Microsoft Active Directory Federation Services ADFS is an Active Directory Federation Service that runs on Windows systems. The service provides Web Single Sign-On SSO technology, which enables...

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a...