6174 matches found
CentOS Web Panel SQL Injection Vulnerability (CNVD-2020-43616)
CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxaddmailbox.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which stems from the program not properly validating a user-supplied string. An attacker could exploit this vulnerability t...
Zoho ManageEngine Desktop Central Integer Overflow Vulnerability
Zoho ManageEngine Desktop Central is integrated desktop and mobile device management software that helps manage servers, laptops, desktops, smartphones and tablets from a central location. An integer overflow vulnerability exists in the client for Zoho ManageEngine Desktop Central versions prior ...
CentOS Web Panel Code Execution Vulnerability (CNVD-2020-43143)
CentOS Web Panel CWP is a free web hosting control panel that makes it easy to manage multiple servers Dedicated and VPS without having to access the servers via SSH. A code execution vulnerability in CentOS Web Panel version cwp-e17.0.9.8.923, which stems from the ajaxdashboard.php file not...
PT-2020-15449 · Jenkins · Jenkins Gitlab Authentication Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Gitlab Authentication Plugin versions 1.5 and earlier Description: The issue arises from the plugin not performing proper group authorization checks, leading to a privilege escalation. Specifically, it does not differentiate between...
CVE-2020-7282
Privilege Escalation vulnerability in McAfee Total Protection MTP before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious...
Exploit for Improper Handling of Exceptional Conditions in Sockjs_Project Sockjs
CVE-2020-7693: Meteor A demo Meteor app running the vuln...
IBM Maximo Asset Management SQL Injection Vulnerability (CNVD-2020-34982)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A SQL injection...
PT-2021-10979 · Speex +1 · Speex +1
Name of the Vulnerable Software and Affected Versions: Speex version 1.2 Description: A stack buffer overflow in speexenc.c allows attackers to cause a denial of service DoS via a crafted WAV file. The vendor states that the issue cannot be reproduced and that it is a demo program. Recommendation...
PT-2020-14543 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the...
PT-2020-14534 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax dashboard.ph...
Huawei Mate 30 Information Disclosure Vulnerability
Huawei Mate 30 is a smartphone from the Chinese company Huawei Huawei. A security vulnerability exists in previous versions of Huawei Mate 30 10.1.0.126 C00E125R5P3, which stems from the system failing to properly connect to Bluetooth. An attacker could exploit the vulnerability by spoofing as an...
PT-2020-14068 · Dmitry · Dmitry
Name of the Vulnerable Software and Affected Versions: DMitry version 1.3a Description: A stack-based buffer overflow might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by the nic format buff function. Recommendations: For DMitry version...
GLSA-202006-14 : PEAR Archive_Tar: Remote code execution vulnerability
The remote host is affected by the vulnerability described in GLSA-202006-14 PEAR ArchiveTar: Remote code execution vulnerability An issue was discovered in the PEAR module ArchiveTars handling of file paths within Tar achives. Impact : A local or remote attacker could possibly execute arbitrary...
PEAR Archive_Tar: Remote code execution vulnerability
Background This class provides handling of tar files in PHP. Description An issue was discovered in the PEAR module ArchiveTar’s handling of file paths within Tar achives. Impact A local or remote attacker could possibly execute arbitrary code with the privileges of the process. Workaround Avoid...
OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery Vulnerabilities
Exploit for php platform in category web applications Product: OX Guard Vendor: OX Software GmbH Internal reference: GUARD-179 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 2.10.3 Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed...
OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery
Product: OX Guard Vendor: OX Software GmbH Internal reference: GUARD-179 Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 2.10.3 Vulnerable component: guard Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 2.10.2-rev9, 2.10.3-rev4 Vendor notification...
OX App Suite / OX Documents 7.10.3 XSS / SSRF / Improper Validation
Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange GmbH...
PT-2020-18917 · Wago · Wago Pfc 200
Name of the Vulnerable Software and Affected Versions: WAGO PFC 200 version 03.03.1015 Description: A code execution issue exists in the Web-Based Management functionality, allowing remote code execution through specially crafted HTTP requests. An attacker can trigger this issue by making an...
GHSA-R24H-634P-M72X Validation Bypass in schema-inspector
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...
