Taiyuan Xunyi Technology Co., Ltd. 74cms background SQL injection vulnerability

74cms Knight cms talent system is a free open source professional recruitment system based on PHP + MYSQL as the core development. Taiyuan Xunyi Technology Co., Ltd. 74cms background SQL injection vulnerabilities, attackers can exploit the vulnerability to obtain database sensitive information...

Heybbs micro-community suffers from SQL injection vulnerability (CNVD-2020-45134)

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs Micro Community has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in NetShow CMS Backend

Netspan CMS is a website management system developed by Netspan Technology. SQL injection vulnerability exists in the backend of Nethub CMS, which can be exploited by attackers to obtain sensitive information from the database...

Xiaomi Mi Jia ink-jet printer injection vulnerability

Xiaomi Mi Jia ink-jet printer is a multifunctional printer from China's Xiaomi Technology Xiaomi. A security vulnerability exists in versions prior to Xiaomi Mi Jia ink-jet printer 3.4.60138. The vulnerability can be exploited by an attacker to inject parameters into the ippserver via the web...

Directory Traversal

djangosendfile2 is vulnerable to directory traversal. The vulnerability exists as the nginx backend does not limit file paths to the SENDFILEROOT...

[SECURITY] Fedora 31 Update: moby-engine-19.03.11-1.ce.git42e35e6.fc31

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This me ans they can run anywhere, from your laptop to the largest EC2 compute instance and everything in between - and they don'...

Stored Cross-Site Scripting Vulnerability in phpyun Backend

phpyun a PHP and MySQL database to build an efficient talent and enterprise job search recruitment, hiring solutions. A stored cross-site scripting vulnerability exists in the backend of phpyun. An attacker can exploit the vulnerability to obtain an administrator cookie...

Multiple SQL Injection Vulnerabilities in DM Enterprise Website System Backend

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website building system background there are multiple SQL injection vulnerabilities. Attackers can use the vulnerability to...

CVE-2020-11041

In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend alsa, oss, pulse, .... The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot...

Testimonial Rotator < 3.0.3 - Authenticated Stored Cross-Site Scripting (XSS)

A Stored XSS vulnerability has been found in the 'Author Information' textarea in testimonials from the plugin, which could allow an authenticated medium-privileged user contributor+ to inject arbitrary JavaScript. The XSS will be triggered for anyone visiting public posts or testimonial page...

DEBIAN-CVE-2020-14212

FFmpeg through 4.3 has a heap-based buffer overflow in aviogetstr in libavformat/aviobuf.c because dnnbackendnative.c calls ffdnnloadmodelnative and a certain index check is omitted...

CVE-2020-16122

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages...

UBUNTU-CVE-2020-16122

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages...

CVE-2020-10755

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

Default credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

UBUNTU-CVE-2020-10755

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleI...

Design/Logic Flaw

agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct...

Design/Logic Flaw

goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to b...

Weak Password Vulnerability in SG-6000 Next-Generation Firewall from Shanshi Netcom

SG-6000 Next-Generation Firewall is a firewall product with intrusion prevention technology based on in-depth application, protocol detection and attack principle analysis. A weak password vulnerability exists in SG-6000, which can be exploited by attackers to access the backend management system...

SQL Injection Vulnerability in SiteServer CMS Backend

SiteServer CMS is an open source and free enterprise-level CMS system developed by Beijing Baiyong Qianwei Software Technology Development Co. A SQL injection vulnerability exists in the backend of SiteServer CMS. An attacker can exploit the vulnerability to obtain sensitive information in the...