CVE-2019-6961

Incorrect access control in actionHandlerUtility.php in the RDK RDKB-20181217-1 WebUI module allows a logged in user to control DDNS, QoS, RIP, and other privileged configurations intended only for the network operator by sending an HTTP POST to the PHP backend, because the page filtering for...

SQL Injection Vulnerability in the Backend of Kewe Polymerization Navigation System v1.7

Kewe Polymerization Navigation System is a full-featured web site navigation system made with PHP+MYSQL. A SQL injection vulnerability exists in the backend of Kovi Convergent Navigation v1.7. A remote attacker can exploit this vulnerability to obtain sensitive database information...

File upload vulnerability in the background ap***_co***.php file of PHPOK enterprise website building system

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. A file upload vulnerability exists in the apco.php file in the background of the PHPOK enterprise website system. Remote attackers can use this vulnerability to obtain server administrative privileges...

RHEL 8 : gvfs (RHSA-2019:1517)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1517 advisory. GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure...

gvfs: Incorrect authorization in admin backend allows privileged users to read and modify arbitrary files without prompting for password

An incorrect permission check in the admin backend in gvfs was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users...

GA Backend Tracking <= 1.2 - XSS

The Google Analytics Backend Tracking woocommerce support – WordPress Plugin WordPress plugin was affected by a XSS security vulnerability...

Universal Password Vulnerability in Water and Rainfall Data Distribution System of Hangzhou Yuanshi Technology Co.

Water and rain data release system is developed and technically supported by Hangzhou Yuanshi Technology Co., Ltd, which is a platform for water conservancy departments to publicize water and rain information. There is a universal password login vulnerability in the water and rain data...

Support Board - Chat And Help Desk | Support & Chat <= 1.2.8 Stored XSS

Info: Weak security measures like bad textarea data filtering has been discovered in the «Support Board - Chat And Help Desk | Support & Chat». Demo Website: https://codecanyon.net/item/support-board-chat-and-help-desk/20752085 Backend: https://board.support/desk-demo/?login=true Login / Password...

SQL Injection Vulnerability in QCMS Backend

QCMS website management system is a PHP lightweight system developed through MVC architecture. There is a SQL injection vulnerability in the backend of QCMS, which can be exploited by attackers to obtain sensitive database information...

Support Board - Chat And Help Desk | Support & Chat <= 1.2.8 Stored XSS

Info: Weak security measures like bad textarea data filtering has been discovered in the «Support Board - Chat And Help Desk | Support & Chat». Demo Website: https://codecanyon.net/item/support-board-chat-and-help-desk/20752085 Backend: https://board.support/desk-demo/?login=true Login / Password...

PT-2019-2539 · Vmware +1 · Vmware Workstation +1

Name of the Vulnerable Software and Affected Versions: VMware Workstation versions 15.x before 15.1.0 Description: The issue is related to a use-after-free vulnerability in the Advanced Linux Sound Architecture ALSA backend of the VMware Workstation hypervisor. This vulnerability can be exploited...

Race condition

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

ALPINE-CVE-2019-12448

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

DEBIAN-CVE-2019-12448

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

CVE-2019-12448

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

CVE-2019-12448

CVE-2019-12448 affects GNOME gvfs 1.29.4–1.41.2 in gvfsbackendadmin.c, which has race conditions because the admin backend doesn’t implement query_info_on_read/write. Connected Nessus entries (e.g., TDs from TencentOS/Tenable) list this CVE among gvfs-related issues and confirm the affected range...

CVE-2019-12448

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

CVE-2019-12448

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...

WMCMS system backend template list exists arbitrary file deletion vulnerability

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS system background template list exists arbitrary file deletion vulnerability. Attackers can use the vulnerability to delete arbitrary files, resulting in system reinstallation...

CVE-2019-12448

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...