CVE-2020-25044

Kaspersky Virus Removal Tool KVRT prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to eliminate content of any file in the system...

Schneider Electric APC Easy UPS On-Line SoundUploadServlet Path Traversal Vulnerability

The Schneider Electric APC Easy UPS On-Line is a UPS solution. A path traversal vulnerability exists in the Schneider Electric APC Easy UPS On-Line SoundUploadServlet, which can be exploited by a remote attacker to submit a special request to upload any file to any directory...

The vulnerability of the installation file of the Kaspersky VPN Secure Connection antivirus software allows a hacker to delete any files in the system.

The vulnerability of the installation file of the Kaspersky VPN Secure Connection antivirus tool is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to delete any files from the system...

The vulnerability of the Kaspersky Virus Removal Tool’s antivirus protection mechanism, related to deficiencies in access control, allows a malicious user to delete any file in the system.

The vulnerability of the Kaspersky Virus Removal Tool KVRT is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to delete the content of any arbitrary file in the system...

Microsoft OneDrive power-up vulnerability

Microsoft OneDrive is a cloud backup application from Microsoft USA. The program features automatic backup of photo albums, online office and file sharing. A power lifting vulnerability exists in Microsoft OneDrive. The vulnerability can be exploited by an attacker with the help of a specially...

CVE-2020-10288

IRC5 exposes an ftp server port 21. Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted...

CVE-2020-5356

Dell PowerProtect Data Manager PPDM versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines...

hw: Special Register Buffer Data Sampling (SRBDS)

A new domain bypass transient execution attack known as Special Register Buffer Data Sampling SRBDS has been found. This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this fl...

SSB-DB Information Disclosure Vulnerability

SSB-DB is a security information storage plug-in. An information disclosure vulnerability exists in SSB-DB version 20.0.0, which stems from the 'get' method that can decrypt any message and can be exploited by an attacker to access private data...

Logic flaw vulnerability in 5vshop e-commerce system (CNVD-2020-33242)

5vshop e-commerce system is an enterprise-level open source e-commerce system. 5vshop e-commerce system has a logic flaw vulnerability that can be exploited by an attacker to purchase any goods...

ursus-md.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1161853 Security Researcher Teamhash Helped patch 390 vulnerabilities Received 3 Coordinated Disclosure badges Received 2 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ursus-md.ru website and its...

PT-2020-6929

Name of the Vulnerable Software and Affected Versions libcroco versions 0.6.13 and earlier Description The issue is related to the cr parser parse any core function in the cr-parser.c component of the libcroco library, which is used for working with cascading style sheets css2. It is associated...

php: memcpy with negative length via crafted DNS response

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dnsgetrecord misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects phpparser...

holz-becker.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1142773 Security Researcher Hchabik Helped patch 2358 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting holz-becker.com website and...

File Deletion Vulnerability in YCCMS Controller Directory Na***.class.php

YCCMS is a PHP version of a lightweight CMS builder. A file deletion vulnerability exists in the YCCMS controller directory Na.cl.php, which can be exploited by an attacker to delete any file in any directory...

Security Bulletin: Privilege escalation in IBM® Db2® tool db2cacpy (CVE-2018-1685).

Summary A vulnerability exists in db2cacpy which could expose sensitive information to user. Vulnerability Details CVEID: CVE-2018-1685 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server contains a vulnerability in db2cacpy that could allow a local user to read any file ...

DRUPAL-CONTRIB-2020-004

The Profile module enables you to allow users to have configurable user profiles. The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users...

Logic flaw vulnerability in the uc***.php file in the frontend of Five Fingers CMS

Five Fingers CMS is an open source content management system. A logic flaw vulnerability exists in the uc.php file in the frontend of Five Fingers CMS. Attackers can use the vulnerability to log in to any user , access sensitive information , to perform unauthorized operations...

Ltd. happy city localized e-commerce APP has logic flaws vulnerability

Happy Merchant App is a store management software that serves merchant users. There is a logic flaw vulnerability in the Happy City localized e-commerce APP of Jiangsu Patrol Network Technology Co. Attackers can utilize the vulnerability to log in to the system with any user including the merchan...

CVE-2019-19033

Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any username and the hardcoded dev password...