Code execution vulnerability in imcat backend

Intimate cat imcat is a PHP + MySQL architecture and design of a general-purpose website system, simple, lightweight, practical, sharing, permanent open source free of charge. imcat backend code execution vulnerabilities exist. Attackers can exploit the vulnerability to execute arbitrary code...

SQL execution vulnerability in imcat backend

Intimate cat imcat is a PHP + MySQL architecture and design of a general-purpose website system, simple, lightweight, practical, sharing, permanent open source free of charge. There is a SQL execution vulnerability in the imcat backend. Attackers can use the vulnerability to obtain sensitive...

evolution security and bug fix update

evolution 3.28.5-12 - Add patch for RH bug 1778799 New Mail account wizard ignores email address change 3.28.5-11 - Update patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar 3.28.5-10 - Add patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar - Add patch for RH bug...

Backend File Upload Vulnerability in phpSQLiteCMS

phpSQLiteCMS is an open source web content management system based on PHP and SQLite. A backend file upload vulnerability exists in phpSQLiteCMS, which can be exploited by attackers to gain control of a web server...

Design/Logic Flaw

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue...

Design/Logic Flaw

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client...

CVE-2020-5889

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client...

Privilege Escalation

gvfs is vulnerable to privilege escalation. A race condition in daemon/gvfsbackendadmin.c allows escalation of privileges due to admin backend not implementing queryinfoonread/write...

Code execution vulnerability in ejucms backend

EJU real estate system ejucms is a set of localized O2O real estate website platform system. Code execution vulnerabilities exist in the background of ejucms, attackers can exploit the vulnerability to execute malicious code to obtain server privileges...

F5 Networks BIG-IP : TMM vulnerability (K43450419)

Undisclosed requests can lead to a denial of service DoS when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure. CVE-2020-5871 Impact...

Command execution vulnerability in EyouCms backend (CNVD-2020-28132)

eyoucms is an enterprise website building system that focuses on enterprise website construction. A command execution vulnerability exists in the EyouCms backend, which can be exploited by attackers to execute malicious commands to gain server privileges...

F5 Networks BIG-IP : BIG-IP APM portal access reflected XSS vulnerability (K24415506)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.4 / 15.0.1.3 / 15.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K24415506 advisory. - On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a...

gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c

It was discovered that gvfs incorrectly set the ownership of files handled by the admin:// backend. An attacker could abuse this flaw when the destination file of a copy/move operation is handled by the admin:// backend. The attacker would have access to the target files with the ability to read...

gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move and copy with GFILECOPYALLMETADATA operations from admin:// to file:// URIs, because root privileges are unavailable...

XSS Vulnerability in Heybbs Micro Community

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs Micro Community has an XSS vulnerability that can be exploited by attackers to obtain administrator cookies...

Command Execution Vulnerability in WeiPHP Backend Ap***.php Page

WeiPHP is an open source WeChat public platform development framework, can easily build a personal WeChat public account operation platform. WeiPHP Ap.php page in the background there is a command execution vulnerability, attackers can use the vulnerability to obtain server privileges...

File Upload Vulnerability in Kangbang Smart Campus Backend

Beijing Kangbang Technology Co., Ltd. is a well-known education technology service group in China, and is a leading enterprise in the field of intelligent education in China. A file upload vulnerability exists in the background of Kangbang Smart Campus, which can be exploited by attackers to gain...

Project iKy v2.5.0 - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface

Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Installation Clone repository git clone https://gitlab.com/kennbroorg/iKy.git Install Backend Redis You must install Redis wget...

HackerOne: Potential stored Cross-Site Scripting vulnerability in Support Backend

HackerOne maintains an internal Support Backend system for employees. On the internal user profiles for hackers, a small overview is shown that lists the skills the user tagged their penetration tester profile with. Although the skills are currently managed by HackerOne and a user can only pick...