IBM Cloud Private Information Disclosure Vulnerability (CNVD-2018-26025)

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. A security vulnerability exists in IBM Cloud Private version 3.1.0, which stems from the program's failure to use a secure channel e.g., SSL to...

CVE-2018-19312

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.24 allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI...

CVE-2018-18763

SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=SQL SQL Injection...

TELEPORT Cross-Site Scripting Vulnerability

tp4a TELEPORT is a bastion system. The system supports hopping and management of RDP and SSH protocols. A cross-site scripting vulnerability exists in tp4a TELEPORT version 3.1.0, which stems from the program failing to properly handle specially crafted usernames. A remote attacker can exploit th...

ZyXEL ZyWALL USG Cross-Site Request Forgery Vulnerability

ZyXEL ZyWALL USG is a network security firewall appliance from Hopkins ZyXEL Technology. A cross-site request forgery vulnerability exists in ZyXEL ZyWALL USG version 2.12 AQQ.2 and 3.30 AQQ.7. A remote attacker can exploit this vulnerability by adding user accounts with the help of the 'cmd'...

File upload vulnerability in YCCMS v3.3 system (CNVD-2018-24653)

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS v3.3 system has a file upload vulnerability that can be exploited by attackers to upload arbitrary files and gain control of the web server...

CVE-2018-18840

XSS was discovered in SEMCMS PHP V3.4 via the SEMCMSSeoAndTag.php?Class=edit&CF=SeoAndTag tagindexmetatit parameter...

CVE-2018-18744

An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMSMain.php URI...

SEMCMS Cross-Site Request Forgery Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 3.4 cross-site request forgery vulnerability exists, remote attackers can use admin/SEMCMSUser.php?Class=add&CF=user URI to perform unauthorized operations...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01723)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A cross-site scripting vulnerability exists in SEMCMS version 3.4, which can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of the first input field of...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01724)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A cross-site scripting vulnerability exists in SEMCMS version 3.4, which can be exploited by remote attackers to inject arbitrary Web script or HTML into the Keywords field of the...

Arbitrary Password Reset Vulnerability in YCCMS V3.3

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS V3.3 has an arbitrary password reset vulnerability. The vulnerability is due to the background change the administrator user password failed to verify the original...

DEBIAN-CVE-2016-10729

An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root...

s-cms code execution vulnerability

s-cms is a content management system CMS based on PHP and MySQL. A security vulnerability exists in the file management for website security in s-cms version 3.0. The vulnerability can be exploited by remote attackers to generate robots.php files with the help of the 'txt' parameter of the...

CVE-2018-18417

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

Intel Rapid Web Server webserver component information disclosure vulnerability

Intel Rapid Web Server is a rapid storage server from Intel Corporation. webserver is one of the web server components. A security vulnerability exists in the webserver component of Intel Rapid Web Server version 3. An attacker can exploit this vulnerability by accessing the network to obtain...

Cisco Firepower System Software Detection Engine Denial of Service Vulnerability

Cisco Firepower System Software is a next-generation firewall product NGFW from Cisco. A denial of service vulnerability exists in the implementation of the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocols in Cisco Firepower System Software, which stems from the program failing ...

CVE-2018-1749

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484...

OTCMS cross-site scripting vulnerability (CNVD-2018-19744)

OTCMS is an article-based web content management system CMS. A cross-site scripting vulnerability exists in the admin/shareswitch.php file in OTCMS version 3.61. A remote attacker can use the 'fieldName', 'fieldName2' and 'tabName' parameters to inject arbitrary Web script or HTML with the...

CVE-2018-12160

DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may allow an authenticated user to potentially execute code using default directory permissions via local access...