Universal Password Vulnerability in Water and Rainfall Data Distribution System of Hangzhou Yuanshi Technology Co.

Water and rain data release system is developed and technically supported by Hangzhou Yuanshi Technology Co., Ltd, which is a platform for water conservancy departments to publicize water and rain information. There is a universal password login vulnerability in the water and rain data...

Logic Flaw Vulnerability in Acme CMS

Acme CMS is a CMS builder using PHP + Mysql architecture, multi-language, responsive display, suitable for personal website construction. Acme CMS has a logic flaw vulnerability that can be exploited by attackers to forge an administrator cookie to log into the backend...

Logic flaw vulnerability in cms system of Wave Group Ltd.

i.e. Wave Group, which owns four listed companies, namely Wave Information, Wave Software, Wave International and Huaguang Optoelectronics, with business covering four industry clusters, namely cloud data center, cloud service big data, smart city and smart enterprise, provides IT products and...

Weak Password Vulnerability in Trunkey's ICP/IP Address Information Filing Management System

Trunkey ICP/IP address information filing management system is a set of ISP service provider enterprise side filing management system. A weak password vulnerability exists in the Trunkey ICP/IP address information filing management system. The vulnerability is due to the fact that the password is...

Universal Password Login Vulnerability in Tatsui Import Server System

Shanghai Chenrui Information Technology Company, is a wholly-owned subsidiary of the Third Research Institute of the Ministry of Public Security. It is mainly engaged in the development and integration of products in computer network security, mobile storage security and terminal security. There ...

Updated gvfs packages fix security vulnerability

The backend currently allows to access and modify files without prompting for password if any polkit authentication agent isn't available. This affects only users which belong to wheel group i.e. those who are already allowed to use sudo. It doesn't allow privilege escalation for users, who don't...

Mogul Interactive website builder system backstage login page has a universal password login vulnerability

Xi'an Mogul Interactive Technology Co., Ltd. is to provide a series of services for enterprises from website building analysis, web design, website optimization and so on. There is a universal password login vulnerability in the background login page of Mogul Interactive website builder system,...

Unauthorized Access Vulnerability in YCCMS v3.3 System

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS v3.3 system has an unauthorized access vulnerability, which can be exploited by attackers to directly access the background without logging in and perform any operation ...

Vulnerability of Universal Password Login in Changmeng Network Website Building System

Changmeng Network is a professional team specializing in providing website construction, website promotion and network marketing solutions under the banner of Guangzhou Xingmeng Animation Design Company Limited a total of three departments: Animation Department, Product Design Department the...

Cookie Spoofing Vulnerability in Website Building System of Henan Yipug Computer Technology Co.

Henan Yipug Computer Technology Co., Ltd. is a service organization that focuses on enterprise network marketing landing. Ltd. building system there is a cookie deception vulnerability, the attacker has been verified through the success of the cookie, the use of loopholes without authentication t...

Universal Password Login Vulnerability in Tatsui Import Preamplifier System

Shanghai Chenrui Information Technology Company is a wholly-owned subsidiary of the Third Research Institute of the Ministry of Public Security. With information security as its main business direction, Chenrui is mainly engaged in the development and integration of products in computer network...

Universal password login vulnerability in Suzhou Kodak's security monitoring video platform.

MSS Streaming Media Server is a surveillance video streaming platform from Suzhou Kodak Technology Co. A universal password login vulnerability exists in the Suzhou KODAK Security Surveillance Video Platform. An attacker can utilize the vulnerability to log in to the backend, view all video files...

Authentication Flaw Vulnerability in CMS Made Simple Version 2.2.7

CMS Made Simple is an open source content management system. It is built using PHP and Smarty Engine , which separates content , functionality and templates . CMS Made Simple version 2.2.7 suffers from an authentication flaw vulnerability, which can be exploited by an attacker to elevate an...

Override Access Vulnerability in SiteServer CMS Administration Backend

SiteServer CMS is a web content management system developed by Beijing Billion Software Technology Development Co. A vulnerability exists in the management background of SiteServer CMS. The vulnerability is due to the background access control using JWT technology for identity authentication, HTT...

Variable Override Vulnerability in MetInfo Version 5.3.19 at Password Retrieval

MetInfo is a Content Management System CMS developed using PHP and Mysql. A variable override vulnerability exists in MetInfo version 5.3.19 at the password retrieval. An attacker can exploit the vulnerability to obtain a password reset link, bypass authentication to change the administrator...

CVE-2017-16635

In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...

Cross site scripting

In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...

CVE-2017-16635

In TinyWebGallery v2.4, an XSS vulnerability is located in the mkname, mkitem, and item parameters of the Add/Create module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the TWG Explorer item listing. The request method to...

CVE-2017-11136

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backen...

CVE-2017-11136

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backen...