CVE-2017-16558: Improper Neutralization of Special Elements used in an SQL Command

Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...

CVE-2019-2424

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2424

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2018-2880

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. The supported version that is affected is 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks...

Design/Logic Flaw

Vulnerability in the Oracle Retail Convenience Store Back Office component of Oracle Retail Applications subcomponent: Level 3 Maintenance Functions. The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2424

CVE-2019-2424 affects Oracle Retail Applications — Retail Convenience Store Back Office, subcomponent Level 3 Maintenance Functions, version 3.6. The vulnerability allows an unauthenticated attacker over the network (HTTP) to read, update, insert or delete data, and may cause partial denial of se...

CVE-2018-2880: Undefined Security Weakness

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. The supported version that is affected is 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks...

PT-2019-3122

Name of the Vulnerable Software and Affected Versions Oracle Retail Convenience Store Back Office version 3.6 Description The issue is related to inadequate access control in the Level 3 Maintenance Functions component. It allows an unauthenticated attacker with network access via HTTP to...

PT-2019-3271

Name of the Vulnerable Software and Affected Versions Oracle Retail Applications MICROS Retail-J component version 12.1.2 Description The issue is related to inadequate access control in the Back Office component of MICROS Retail-J, allowing an unauthenticated attacker with network access via HTT...

CVE-2018-17287

CVE-2018-17287 affects Kofax Front Office Server Administration Console (version 4.1.1.11.0.5212). The issue arises because some fields (e.g., passwords) are obfuscated in the front-end but can be exfiltrated via the back-end download feature (mfp.password downloadsettingvalue operation). This co...

Oracle Retail Applications Retail Convenience Store Back Office Access Control Error Vulnerability

Oracle Retail Applications is the United States Oracle Oracle company's set of retail applications store solutions. The product includes inventory management, sales management and customer management , etc. Retail Convenience Store Back Office is one of the retail back office components. A securi...

Oracle Retail Applications MICROS Retail-J Access Control Error Vulnerability

Oracle Retail Applications is the United States Oracle Oracle company's set of retail applications store solutions. The product includes inventory management, sales management and customer management, etc. MICROS Retail-J is one of the advanced retail system components. A security vulnerability...

CVE-2019-4012: Improper Neutralization of Special Elements used in an SQL Command

IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 155886...

CVE-2018-1994

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 154494...

CVE-2018-1356

A reflected Cross-Site-Scripting XSS vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the backurl parameter in the file scan component...

PT-2019-6213

Name of the Vulnerable Software and Affected Versions FortiSandbox versions prior to 3.0 Description A reflected Cross-Site-Scripting XSS issue exists due to insufficient protection of the web page structure in the file scan component. This may allow an attacker to execute unauthorized code or...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : QEMU vulnerabilities (USN-3923-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3923-1 advisory. Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could u...

USN-3923-1 qemu vulnerabilities

Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could use this issue to read or write arbitrary files and cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.10. CVE-2018-16867...

CVE-2019-6716

An unauthenticated Insecure Direct Object Reference IDOR in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs backup and synchronization jobs, which could...

Back To Top - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-040

This module enables you to add a button that hovers in the bottom of your screen and allows users to smoothly scroll up the page using jQuery. The module doesn't sufficiently sanitize the code that gets printed on pages leading to a Cross Site Scripting XSS issue. This vulnerability is mitigated ...