File Upload Vulnerability in opencart 3.6

OpenCart is an open source e-commerce system. A file upload vulnerability exists in opencart 3.6, which can be exploited by an attacker to execute commands and gain server administrator privileges...

3S-Smart Software Solutions CODESYS V3 web server buffer overflow vulnerability (CNVD-2020-20436)

3S-Smart Software Solutions CODESYS V3 web server is a web server used in CODESYS products from 3S-Smart Software Solutions, Germany. A buffer overflow vulnerability exists in 3S-Smart Software Solutions CODESYS V3 web server versions prior to 3.5.15.40 used in the CODESYS Control runtime system...

Mozilla Bleach Cross-Site Scripting Vulnerability

Mozilla Bleach is an HTML cleanup library from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in bleach.clean in Mozilla Bleach versions prior to 3.12. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

IBM Content Navigator Information Disclosure Vulnerability (CNVD-2020-19221)

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A security vulnerability exists in IBM Content Navigator version 3.0CD. An attacker can exploit the vulnerability to obtain sensitive informati...

UBUNTU-CVE-2020-6802

In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option...

CVE-2019-18242

In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multiple requests for short-term use may cause the web server to fail...

ELOG Electronic Logbook Code Issue Vulnerability

ELOG is a web application written in C for creating personal and general purpose logs. A code issue vulnerability exists in the handling of HTTP parameters in ELOG Electronic Logbook version 3.1.4-283534d, which can be exploited by remote attackers to cause a denial of service via a specially...

Nagios NRPE Heap Buffer Overflow Vulnerability

Nagios NRPE is an extension of Nagios to execute plug-in programs on remote Linux/Unix hosts. A heap buffer overflow vulnerability exists in Nagios NRPE 3.2.1. An attacker could exploit this vulnerability to cause a denial of service...

Invision Power Services Invision Power Board Cross-Site Scripting Vulnerability

Invision Power Board is a PHP and MySQL based forum program. A cross-site scripting vulnerability exists in Invision Power Board versions 2.x through 3.0.4, which originates from a web application that lacks proper validation of client-side data. An attacker can exploit this vulnerability to...

BSA-2020-936

Security Advisory ID : BSA-2020-936 Component : SMBv3 Revision : 1.0: Final Microsoft SMBv3 contains a vulnerability in the handling of compression, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Server Message Block 3.1....

CVE-2020-10578

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...

CVE-2020-10218

A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function...

Warning — Unpatched Critical 'Wormable' Windows SMBv3 Flaw Disclosed

Shortly after releasing its monthly batch of security updates, Microsoft late yesterday separately issued an advisory warning billions of its Windows users of a new critical, unpatched, and wormable vulnerability affecting Server Message Block 3.0 SMBv3 network communication protocol. It appears...

SAP Landscape Management Input Validation Error Vulnerability (CNVD-2020-18534)

SAP Landscape Management is a centralized SAP product management system from SAP. The system is used to centrally manage and configure SAP software systems running in physical, virtual, and cloud infrastructures. An input validation error vulnerability exists in SAP Landscape Management version...

Mozilla Bleach Cross-Site Scripting Vulnerability

Mozilla Bleach is an HTML cleanup library from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Bleach versions prior to 3.11. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

SQL Injection Vulnerability in ILAS III Digital Library System

Integrated Library Automation System ILAS is a set of integrated library automation system that can be adapted to the use of libraries of different levels, scales and types at home and abroad, which is undertaken and organized by the Shenzhen Library. ILAS III digital library system SQL injection...

CVE-2020-8952

Fiserv Accurate Reconciliation 2.19.0, fixed in 3.0.0 or higher, allows XSS via the logout.jsp timeOut parameter...

Easy Property Listings Cross-Site Request Forgery Vulnerability

Easy Property Listings is a property listings plugin. A cross-site request forgery vulnerability exists in versions prior to Easy Property Listings 3.4. The vulnerability stems from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could...

Serendipity freetag cross-site scripting vulnerability

Serendipity is a PHP-based blogging system from the Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Serendipity freetag plugin versions prior to 3.30. The vulnerability stems from a lack of proper...

CVE-2020-6177

SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server...