Security Bulletin: An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.

Summary PowerVM partition firmware is the portion that executes in each partition during boot. On POWER9 systems an attacker that gains service access to the FSP can compromise partition firmware for any partition configured on the system. On all affected systems an attacker that gains admin...

CVE-2019-12354

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php when the attacker has admin authority via the id parameter...

CVE-2019-12359

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyansendmail.php when the attacker has admin authority via the id parameter...

CVE-2019-12357

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php when the attacker has admin authority via the id parameter...

CVE-2019-12353

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dlsendmail.php when the attacker has admin authority via the id parameter...

Sql injection

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php when the attacker has admin authority via the id parameter...

Sql injection

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php when the attacker has admin authority via the id parameter...

Sql injection

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dlsendmail.php when the attacker has admin authority via the id parameter...

Sql injection

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyansendmail.php when the attacker has admin authority via the id parameter...

CVE-2019-12353

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dlsendmail.php when the attacker has admin authority via the id parameter...

CVE-2019-12353

The CVE-2019-12353 entry affects ZZCMS 2019. A SQL injection vulnerability exists in /admin/dl_sendmail.php when an attacker has admin authority, exploitable via the id parameter. The Red Hat and CNVD/CNNVD, CVE records corroborate the same description. Impact is described as enabling information...

CVE-2019-12354

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php when the attacker has admin authority via the id parameter...

CVE-2019-12357

CVE-2019-12357 affects ZZCMS 2019. The Red Hat/EUVD/CNVD/CVE records describe a SQL injection vulnerability in /admin/deluser.php when an attacker has admin authority, exploitable via the id parameter. Publicly available references corroborate the issue as a site‑level SQLi in ZZCMS 2019, with no...

CVE-2019-12357

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php when the attacker has admin authority via the id parameter...

CVE-2019-12359

An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyansendmail.php when the attacker has admin authority via the id parameter...

CVE-2019-12359

CVE-2019-12359 concerns ZZCMS (2019 version) with a SQL injection vulnerability in the admin module. Specifically, /admin/ztliuyan_sendmail.php is vulnerable via the id parameter when the attacker has admin authority, enabling manipulation of the database (as indicated by the vulnerability descri...

DotCMS 4.1.1 Shell Upload Vulnerability

DotCMS version 4.1.1 suffers from a remote shell upload vulnerability. ========================== Advisory: DotCMS /servlets/ajaxfileupload Arbitrary File Upload Vulnerability Author: email protected From DBAppSecurity Security Lab Email: email protected Affected Version: 4.1.1 the latest version...