CVE-2017-5219

An issue was discovered in SageCRM 7.x before 7.3 SP3. The Component Manager functionality, provided by SageCRM, permits additional components to be added to the application to enhance provided functionality. This functionality allows a zip file to be uploaded, containing a valid .ecf component...

Arbitrary Command Execution Vulnerability in Knight CMS

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS version 4.1.0 suffers from an arbitrary command execution vulnerability. Due to the Knight CMS V4.1.0 using the tp framework there is a template engine remote code execution vulnerability. Attackers can exploi...

Fckeditor Arbitrary File Upload Vulnerability and Directory Traversal Vulnerability in Office System of Ningbo Jieda Software Co.

Jeedaa ERP software is designed for domestic small and medium-sized manufacturing enterprises that produce or process on their own, and at the same time incidentally carry out sales. Jeedaa Office Management System Jeedaa OA is a collaborative office management platform. Jeeda eHR is used to...

Arbitrary File Write Vulnerability in FineCMS Backend

FineCMS is a small and medium-sized content management system based on PHP+MySql+CI framework. An arbitrary file write vulnerability exists in the config/site.ini.php page of the FineCMS backend. Allows attackers to upload webshell and gain server privileges...

Arbitrary File Upload Vulnerability in NetSense SECWORLD VPN

NetSense SECWORLD VPN is a secure access gateway system. NetShen SECWORLD VPN has an arbitrary file upload vulnerability. The /admin/account/useraddaction.php page has no restrictions on file uploads, allowing an attacker to directly upload a webshell and gain server privileges...

Faraday v2.2 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

Arbitrary File Upload Vulnerability in Dotclear

Dotclear is an open source free web publishing software, created by Olivier Meunier in 2002. Dotclear suffers from an arbitrary file upload vulnerability. Due to the administrator theme management page blogtheme.php, inc/core/class.dc.modules.php there is a theme legitimacy checking problem,...

Arbitrary file upload vulnerability in the $_FILES ['ttsFile'] and $_POST['taskid'] parameters of the Mixcall agent management system.

Mixcall seat management system is based on B/S architecture, the management personnel can directly log into the Mixcall seat management center through the computer, and view the detailed situation related to the seat personnel's voice services. An arbitrary file upload vulnerability exists in the...

Arbitrary File Upload Vulnerability in SignName Parameter of Tibco Call Center System

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. An arbitrary file upload vulnerability exists in the signName parameter of the Tibus Communication Call Center System. 1 File upload: /sysmaint/import/import.php, save...

File upload vulnerability in the file /justsetting/justsetting3.php of the Tidetime Communications call center system

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. A file upload vulnerability exists in the file /justsetting/justsetting3.php in the Tidetime Communications Call Center System. The vulnerability can be exploited to upload a...

File upload vulnerability in the file /userweb/php/index/daPing.class.php of the Tibus Communications call center system

The core of Tibco's call center system is a communication-based system for internal and external corporate communication. A file upload vulnerability exists in the file /userweb/php/index/daPing.class.php in the Tibco Call Center System. The vulnerability allows an attacker to upload a webshell a...

Tunnel TCP connections over HTTP: Tunna

Tunnel TCP connections over HTTP Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. In a fully firewalled inbound and outbound connections restricted – except the webserver port. The...

Thinksns open source microblogging system has a file upload vulnerability

Thinksns is an open source microblogging system. Thinksns is an open source microblogging system file upload vulnerability, through the local construction of the upload form, can be uploaded webshell, to obtain control of the server...

Enterprise Intelligence Series Internet Behavior Management Appliances Exposed to Arbitrary File Upload Vulnerability

The Enterprise Intelligence series of Internet behavior management devices are dedicated to preventing the malicious spread of illegal information. An arbitrary file upload vulnerability exists in the EIZO series of Internet behavior management devices. An attacker can use the vulnerability to...

PHPCMS V9 version of the background design flaws lead to arbitrary code execution vulnerability

Source link: http://www.cnbraid.com/ 0x01 background Since the default after installation requires Super administrator privileges, so the vulnerability is very tasteless, but the feeling should be in other cms, there are also, so the main share under the mining idea PS: using the test environment...

ZKTeco ZKBioSecurity 3.0 - Hard-Coded Credentials SYSTEM Remote Code Execution

ZKTeco ZKBioSecurity 3.0 - Hard-Coded Credentials SYSTEM Remote Code Execution ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote SYSTEM Code Execution Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version:...

SQL Injection Vulnerability in Remote Rapid Application Access Solution System mxcheckuserMachine.php Page Parameter a of UFIDA Information Technology Ltd.

UFIDA UPC Information Technology Co., Ltd. remote rapid application access solution is to use U8 remote access can be realized instantly access to the company's application systems and enterprise information and simplify the deployment and management of complex computing environment. The product...

ZKTeco ZKBioSecurity 3.0 - Hard-Coded Credentials SYSTEM Remote Code Execution

ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote SYSTEM Code Execution Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 3.0.1.0R230 Platform: 3.0.1.0R230 Personnel: 1.0.1.0R1916 Access: 6.0.1.0R1757...

Beijing Oriental Wenhui Website Group Content Management System Has Design Flaws and Vulnerabilities

Oriental Wenhui Super Website Group Content Management System is a set of platform system specialized in website development and management for government agencies, enterprises and public institutions. The product has a design flaw vulnerability, there is a design flaw in the copy function of the...

Arbitrary File Write Vulnerability on Server Side of NJ MAGAPP Products

MAGAPP is a forum mobile client management system developed for local urban communities, including iOS, Android cell phone, PC management system, independent Discuz and multi-platform sharing components, able to dock the urban community website database and run independently on the local...