OPENSUSE-SU-2019:1128-1 Security update for pdns

This update for pdns fixes the following issue: Security issue fixed: - CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one bsc1129734...

openSUSE Security Update : pdns (openSUSE-2019-1128)

This update for pdns fixes the following issue : Security issue fixed : - CVE-2019-3871: Fixed an insufficient validation in the HTTP remote backend which could allow a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one bsc1129734...

Financial Apps are Ripe for Exploit via Reverse Engineering

A white hat hacker reverse engineered 30 mobile financial applications and found sensitive data buried in the underlying code of nearly all apps examined. With this information a hacker could, for example, recover application programming interface API keys and use them to attack the vendor’s...

File Upload Vulnerability in Z-BlogPHP 1.5.2 Zero Backend

Z-BlogPHP is an open source PHP-based blog system developed by Z-Blog. Z-BlogPHP1.5.2Zero back-end theme management and plug-in management of the existence of file upload vulnerability, attackers can use the vulnerability to obtain control of the web server...

Debian DLA-1737-1 : pdns security update

A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend, allowing a remote user to cause a denial of service by makin...

Arbitrary Code Execution Vulnerabilities in SeaCmsV9.2 Backend

SeaCMS is a video-on-demand system based on PHP+MySql technology. SeaCmsV9.2 background arbitrary code execution vulnerability, SeaCMS background database backup, due to incomplete data filtering leads to arbitrary code execution, the attack can be exploited to obtain server privileges...

File upload vulnerability in Jfinal cms backend site administration

Jfinal cms uses a simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Jfinal cms back-end site management system there is a file upload vulnerability , its back-end site management system there is an...

File Upload Vulnerability in Jfinal cms Backend Article Management System

Jfinal cms, using a simple and powerful JFinal as a web framework, template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Jfinal cms back-end article management system file upload vulnerability , its back-end article management system file upload...

Updated pdns packages fix security vulnerability

Updated pdns packages fix security vulnerability: An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode without post=1 set, allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured...

MGASA-2019-0122 Updated pdns packages fix security vulnerability

Updated pdns packages fix security vulnerability: An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode without post=1 set, allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured...

[SECURITY] [DLA 1737-1] pdns security update

Package : pdns Version : 3.4.1-4+deb8u9 CVE ID : CVE-2019-3871 Debian Bug : 924966 A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building a HTTP request from a DNS query in the HTTP Connector ...

Command Execution Vulnerability in Jfinal cms Backend

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Jfinal cms backend has a command execution vulnerability. Attackers can use the vulnerability to execute arbitrary code...

File Containment Vulnerability in DM Website System Backend

DM building system is developed by php + mysql a set of specialized for small and medium-sized enterprise website construction of open source cms. DM website builder system has a file inclusion vulnerability , attackers can use the vulnerability to obtain sensitive information...

Code execution vulnerability in Jfinal cms backend

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Jfinal cms backend code execution vulnerability exists. An attacker can exploit the vulnerability to execute arbitrary code...

Jfinal cms backend has a directory traversal vulnerability

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Jfinal cms backend has a directory traversal vulnerability. An attacker can use this vulnerability to traverse the directory and obtain sensitive...

Jfinal cms backend has arbitrary file read vulnerability

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Jfinal cms backend exists arbitrary file read vulnerability. Attackers can use the vulnerability to read the database configuration file...

Arbitrary Directory Deletion Vulnerability in Ear Distribution CMS Backend

Ear Distribution CMS is a content management system. An arbitrary directory deletion vulnerability exists in the backend of Ear Distribution CMS, where an attacker can log in to the system and delete arbitrary files by modifying the file path...

xycmslyb v1.9 SQL Injection Vulnerability in Background

xycmslyb is a business building software. xycmslyb v1.9 suffers from a SQL injection vulnerability in the backend, which can be exploited by attackers to obtain sensitive information from the database...

Universal Password Login Vulnerability in Tatsui Import Server System

Shanghai Chenrui Information Technology Company, is a wholly-owned subsidiary of the Third Research Institute of the Ministry of Public Security. It is mainly engaged in the development and integration of products in computer network security, mobile storage security and terminal security. There ...

Design/Logic Flaw

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running unde...