LJCMS suffers from a file upload vulnerability (CNVD-2020-29397)

LJCMS is a PHP+MYSQL+Smarty based, free and open source enterprise website system. LJCMS has a file upload vulnerability that can be exploited by attackers to upload malicious files and gain administrator privileges...

Universal Password Login Vulnerability in Jinki CRM Customer Management System

Jinko CRM customer management system is a mobile customer management system software. A universal password login vulnerability exists in CRM Customer Management System, which can be exploited by an attacker to gain unauthorized access to the system as an administrator...

Command Execution Vulnerability in Surplus Vision HD Recording System

Guangzhou Ncast Electronic Technology Co., Ltd hereinafter referred to as Ncast, founded in 2007, is a high-tech enterprise focusing on three major fields of multimedia communication, video and audio coding and decoding, and intelligent image processing. There is a command execution vulnerability...

File Upload Vulnerability in CRMEB Open Edition V3.1.0

CRMEB mall system is based on ThinkPhp6.0 + Vue development of a set of new retail mobile e-commerce system, CRMEB system is a set of customer relationship management + marketing e-commerce system, can quickly accumulate customers, member data analysis, intelligent conversion of customers,...

CVE-2020-11686

In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings...

PT-2020-6840 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 12.3R12-S16 Juniper Networks Junos OS 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105 Juniper Networks Junos OS 14.1X53 versions prior to 14.1X53-D54 Juniper Networks Junos OS 15.1 versions pri...

Code Execution Vulnerability in CRMEB Open Edition V2.6.13

CRMEB system is a set of customer relationship management + marketing e-commerce system, can really help enterprises based on WeChat public number, small program, to realize the member relationship management, data analysis, accurate marketing e-commerce management system. CRMEB Open Version...

Information disclosure

SAP NetWeaver AS Java HTTP Service, versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure...

Access Restriction Bypass

The GNOME Display Manager GDM is vulnerable to Access Restriction Bypass. A flaw was found in the way the gdm package was built. The gdm package was missing TCP wrappers support on 64-bit platforms, which could result in an administrator believing they had access restrictions enabled when they di...

Centreon Infrastructure Monitoring Software Code Execution Vulnerability

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A security vulnerability exists in Centreon Infrastructure Monitoring Software version...

CVE-2019-19699

There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. T...

The vulnerability of the SiTex development platform’s SiTex-Gosuslu component, which stems from the absence of a CSRF token in web forms, allows actions to be performed on behalf of users, including administrators.

The vulnerability of the SiTex-Service component of the distributed application development platform involves the absence of a CSRF token in web forms. Exploiting this vulnerability allows an attacker to execute cross-site requests on behalf of users, including administrators, through a specially...

File Upload Vulnerability in opencart 3.6

OpenCart is an open source e-commerce system. A file upload vulnerability exists in opencart 3.6, which can be exploited by an attacker to execute commands and gain server administrator privileges...

Unrestricted file upload

Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a or use an existing directory that is externally accessible to store PHP files. The filename and the exac...

Helium: Cleartext Transmission of Sensitive Information Leads to administrator access

The weakness of the program is Cleartext Transmission of Sensitive Information through URL Leads to administrator access. This program is having one feature like we can add users like administrator and read-only, these are roles, into organizations. Here I get the administrator role at same...

CVE-2020-9456

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users with minimal privileges to elevate their privileges to administrator via classrmusercontroller.php rmuseredit...

CVE-2020-3176

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not properly sanitize user-supplied input. An...

CVE-2020-3176

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not properly sanitize user-supplied input. An...

Input validation

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not properly sanitize user-supplied input. An...

CVE-2020-3176 Cisco Remote PHY Device Software Command Injection Vulnerability

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exists because the affected software does not properly sanitize user-supplied input. An...