CVE-2020-9315

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references...

CVE-2020-9314

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...

CVE-2020-9315

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references...

Code injection

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references...

Design/Logic Flaw

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...

CVE-2020-9314

CVE-2020-9314 affects Oracle iPlanet Web Server 7.0.x. The issue is described as image injection in the Administration console via the productNameSrc parameter to an admingui URI, arising from an incomplete fix for CVE-2012-0516. It is part of a pair with CVE-2020-9315; while CVE-2020-9314 enable...

CVE-2020-9314

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the...

CVE-2020-9315

PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE: a related support policy can be found in the www.oracle.com references...

CVE-2020-9315

Oracle iPlanet Web Server 7.0.x is affected by two CVEs. CVE-2020-9315: authentication bypass via incorrect access control on admingui/version URIs, enabling unauthenticated read access to encryption keys. CVE-2020-9314: image injection via productNameSrc in the admingui, stemming from an incompl...

SIYUCMS 5.1 suffers from a command execution vulnerability (CNVD-2020-31713)

SIYUCMS is a content management system based on ThinkPHP5 + AdminLTE. SIYUCMS 5.1 suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands and gain administrative privileges on the web server...

File inclusion vulnerability in 115CMS backend In***.php file

115CMS is a content management system developed on ThinkPHP framework. A file inclusion vulnerability exists in the 115CMS backend In.php file. An attacker can exploit this vulnerability to upload arbitrary files and gain control of the web server...

CVE-2020-3246

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

Crlf injection

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

CVE-2020-3246 Cisco Umbrella Carriage Return Line Feed Injection Vulnerability

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

CVE-2020-3246 Cisco Umbrella Carriage Return Line Feed Injection Vulnerability

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

CVE-2020-3246

CVE-2020-3246 involves Cisco Umbrella’s web server and a CRLF injection due to insufficient input validation. An unauthenticated, remote attacker could entice a user to visit a crafted URL to inject arbitrary HTTP headers into responses. The connected Cisco advisory notes software updates exist a...

Cisco Umbrella Carriage Return Line Feed Injection Vulnerability

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

File Upload Vulnerability in OurPHP website builder system

OurPHP Aopia website building system is a enterprise + e-commerce marketing website building system. A file upload vulnerability exists in the OurPHP website builder system, which can be exploited by attackers to gain control of the web server...

Arbitrary file write/potential remote code execution in actionpack-page_caching

There is a vulnerability in the actionpack-pagecaching gem that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view. Versions Affected: All versions of actionpack-pagecaching part of Rails...

SAE IT-systems FW-50 Remote Telemetry Unit (RTU)

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: SAE IT-systems Equipment: FW-50 Remote Telemetry Unit RTU Vulnerabilities: Cross-site Scripting, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...