Override access vulnerability in Spike's web version

Nail is a free multi-end platform for communication and collaboration created by Alibaba Group specifically for Chinese enterprises. Nail web version of the existence of bulk user override access vulnerability, an attacker can exploit the vulnerability bulk traversal of hundreds of millions of ui...

Trend Micro Control Manager SQL Injection Remote Code Execution Vulnerability (CNVD-2018-03780)

Trend Micro Control Manager provides forward-looking, comprehensive threat protection with centralized management for security updates, patch deployment, coordinated response, and remote management capabilities that support Trend Micro products and services. A GetXXX method SQL injection remote...

Google Chrome for Mac, Windows and Linux Security Bypass Vulnerability (CNVD-2018-03797)

Google Chrome for Mac, Windows and Linux is a web browser developed by Google, Inc. for the Mac, Windows and Linux platforms. A security vulnerability exists in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac and Linux platforms. A remote attacker can exploit this vulnerability ...

Mozilla Firefox Buffer Overflow Vulnerability (CNVD-2018-02633)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A buffer overflow vulnerability exists in previous versions of Mozilla Firefox 58. An attacker could exploit this vulnerability to cause a denial of service crash...

ASUS Router Buffer Overflow Vulnerability

ASUS routers is a wireless router product from ASUS. A buffer overflow vulnerability exists in the 'ejupdatevariables' function in the router/httpd/web.c file in ASUS routers. An attacker could exploit this vulnerability by sending a request to update settings to execute code...

Hangzhou Hechat Technology Co., Ltd. and Hechat APP suffers from arbitrary number registration and arbitrary password reset vulnerability

Wochat App is a business socialization software. Ltd. and Chat APP has an arbitrary number registration and arbitrary password reset vulnerability. The vulnerability is due to the lack of restrictions on verification code verification, an attacker can register any account and reset any password b...

SQL Injection Vulnerability in Process Banking Infrastructure Platform of Beijing Yinsan Gold Service Technology Co.

The basic platform of process bank is to take the process as the object of IT system implementation, intending to build a commercial bank "assembly line" work platform, according to the product, business line, the process of IT curing, optimization, and ultimately build a complete set of IT syste...

Google Android Qualcomm component elevation of privilege vulnerability (CNVD-2018-02174)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. The Google Android Qualcomm component has an elevation of privilege vulnerability that can be...

Huawei SmartCare dashboard module cross-site scripting vulnerability

Huawei SmartCare is an end-to-end user perception enhancement and assurance solution from Huawei, China, for improving customer experience in the telecom sector. dashboard module is one of the dashboard modules. A cross-site scripting vulnerability exists in the dashboard module in Huawei...

SQL Injection Vulnerability in DSmall Multi-User Mall System

DSmall multi-user mall system is a platform mall system developed by DSmall Network for enterprise-level customers with multiple suppliers and stores, which can realize the modes of platform self-owned and third-party merchants at the same time. There is a SQL injection vulnerability in DSmall...

Palo Alto Networks PAN-OS Denial of Service Vulnerability (CNVD-2017-37960)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A denial of service vulnerability exists in Palo Alto Networks PAN-OS. A remote attacker could exploit this vulnerability to cause a denial of service...

IEEE P1735 Cryptographic Problem Vulnerability (CNVD-2017-33399)

IEEE P1735 is a standard dedicated to encrypting the intellectual property of electronic designs. The implementation of IEEE P1735 is vulnerable to a cryptographic issue. An attacker could exploit this vulnerability to obtain the intellectual property of an electronic design...

Memory corruption vulnerability exists in Sohu Video 5 (CNVD-2017-35531)

Sohu Video 5 is a video player from Sohu. A memory corruption vulnerability exists in the Sohu Video 5 PC client when opening certain mov files, which can be exploited by attackers to cause a denial of service or code execution...

xen denial of service vulnerability (CNVD-2017-30249)

Xen is an open source virtual machine monitor developed by the Xen Project. Xen has a denial of service vulnerability that can be exploited by attackers to cause a denial of service...

Basic Contact Form <= 1.0.3 - Potential Unauthenticated Shell Upload

Uploading attachments in the contact form allows to run any kind of PHP code depending on the server config. The issue is related to this https://www.exploit-db.com/exploits/10089/ one. Explanation there will help to understand the problem. Following code is part of the function...

Linux PDF rendering engine poppler suffers from a denial of service vulnerability

Poppler is used to generate a PDF of the C++ class library , from xpdf inheritance. Linux PDF rendering engine poppler Stream.cc ImageStream::ImageStream there is a denial-of-service vulnerability. Attackers can use this vulnerability to launch denial-of-service attacks...

Multiple Lenovo Products ElanTech Touchpad Driver Elevation of Privilege Vulnerability

Lenovo 300S-11IBR and others are laptop products from the Chinese company Lenovo.ElanTech Touchpad driver is one of the touchpad drivers. A security vulnerability exists in the ElanTech Touchpad driver in several Lenovo products. The vulnerability can be exploited by an attacker to execute code...

Google Chrome heap buffer overflow vulnerability (CNVD-2017-31821)

Google Chrome is an open source web browser. Google Chrome WebGL suffers from a heap buffer overflow vulnerability that allows remote attackers to exploit the vulnerability by submitting a special WEB page, tricking the user into parsing it, and executing arbitrary code...

Google Android Media Framework Information Disclosure Vulnerability (CNVD-2017-31353)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA. Media framework is one of the frameworks used for multimedia development. An information disclosure vulnerability exists in the Android Media framework. An attacker can exploit thi...

SQL injection vulnerability in OURPHP backend ourphp_callback.php page

OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. A SQL injection vulnerability exists in the background ourphpcallback.php page of OURPHP. Attackers can use this vulnerability to obtain sensitive database informatio...