NVIDIA GeForce Experience elevation of privilege vulnerability (CNVD-2018-26667)

NVIDIA GeForce Experience for Windows is a set of automatic update tools for Windows-based graphics cards from NVIDIA. A security vulnerability exists in NVIDIA GeForce Experience for Windows prior to version 3.16. An attacker could exploit this vulnerability to gain elevated privileges...

TerraMaster TOS System Command Injection Vulnerability (CNVD-2019-00661)

TerraMaster TOS is a set of storage server special operating system based on Linux platform developed by Terra Master. The system supports file sharing, cloud data synchronization, data backup and virtualization. The ajaxdata.php file in TerraMaster TOS version 3.1.03 is vulnerable to a command...

IBM Cloud Private Information Disclosure Vulnerability (CNVD-2018-26025)

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. A security vulnerability exists in IBM Cloud Private version 3.1.0, which stems from the program's failure to use a secure channel e.g., SSL to...

CVE-2018-19312

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.24 allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI...

CVE-2018-18763

SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=SQL SQL Injection...

TELEPORT Cross-Site Scripting Vulnerability

tp4a TELEPORT is a bastion system. The system supports hopping and management of RDP and SSH protocols. A cross-site scripting vulnerability exists in tp4a TELEPORT version 3.1.0, which stems from the program failing to properly handle specially crafted usernames. A remote attacker can exploit th...

ZyXEL ZyWALL USG Cross-Site Request Forgery Vulnerability

ZyXEL ZyWALL USG is a network security firewall appliance from Hopkins ZyXEL Technology. A cross-site request forgery vulnerability exists in ZyXEL ZyWALL USG version 2.12 AQQ.2 and 3.30 AQQ.7. A remote attacker can exploit this vulnerability by adding user accounts with the help of the 'cmd'...

File upload vulnerability in YCCMS v3.3 system (CNVD-2018-24653)

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS v3.3 system has a file upload vulnerability that can be exploited by attackers to upload arbitrary files and gain control of the web server...

CVE-2018-18840

XSS was discovered in SEMCMS PHP V3.4 via the SEMCMSSeoAndTag.php?Class=edit&CF=SeoAndTag tagindexmetatit parameter...

CVE-2018-18744

An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMSMain.php URI...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01724)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A cross-site scripting vulnerability exists in SEMCMS version 3.4, which can be exploited by remote attackers to inject arbitrary Web script or HTML into the Keywords field of the...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01723)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A cross-site scripting vulnerability exists in SEMCMS version 3.4, which can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of the first input field of...

SEMCMS Cross-Site Request Forgery Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 3.4 cross-site request forgery vulnerability exists, remote attackers can use admin/SEMCMSUser.php?Class=add&CF=user URI to perform unauthorized operations...

Arbitrary Password Reset Vulnerability in YCCMS V3.3

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS V3.3 has an arbitrary password reset vulnerability. The vulnerability is due to the background change the administrator user password failed to verify the original...

DEBIAN-CVE-2016-10729

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root...

s-cms code execution vulnerability

s-cms is a content management system CMS based on PHP and MySQL. A security vulnerability exists in the file management for website security in s-cms version 3.0. The vulnerability can be exploited by remote attackers to generate robots.php files with the help of the 'txt' parameter of the...

CVE-2018-18417

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

Intel Rapid Web Server webserver component information disclosure vulnerability

Intel Rapid Web Server is a rapid storage server from Intel Corporation. webserver is one of the web server components. A security vulnerability exists in the webserver component of Intel Rapid Web Server version 3. An attacker can exploit this vulnerability by accessing the network to obtain...

Cisco Firepower System Software Detection Engine Denial of Service Vulnerability

Cisco Firepower System Software is a next-generation firewall product NGFW from Cisco. A denial of service vulnerability exists in the implementation of the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocols in Cisco Firepower System Software, which stems from the program failing ...

CVE-2018-1749

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484...