SQL Injection Vulnerability in Five Fingers CMS v4.1.0 Backend

Five Fingers CMS is a high-performance open source content management system that supports LNAMP architecture. Five Fingers CMS v4.1.0 SQL injection vulnerability exists in the background , an attacker can exploit the vulnerability to obtain sensitive information in the database...

Code execution vulnerability in SchoolCMS V2.3.1 backend Sm***.cl***.php

SchoolCMS is a school teaching management system based on PHP+MySQL. A code execution vulnerability exists in the schoolcms backend SmsController.class.php. An attacker can exploit this vulnerability to execute arbitrary code...

SchoolCMS V2.3.1 Code Execution Vulnerability in Backend Se***.cl***.php

SchoolCMS is a school teaching management system based on PHP+MySQL. A code execution vulnerability exists in Schoolcms V2.3.1 backend SeoController.class.php. An attacker can exploit this vulnerability to execute arbitrary code...

SQL Injection Vulnerability in Daimi CMS_V6.0.6

Rice CMS is a free open source, fast, simple PC station and cell phone station building integrated integration system , to provide open source Android cell phone client APK and the corresponding server-side system source code download. Rice CMSV6.0.6 SQL injection vulnerability . Rice CMSV6.0.6...

[SECURITY] Fedora 29 Update: moby-engine-18.06.0-2.ce.git0ffa825.fc29

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This me ans they can run anywhere, from your laptop to the largest EC2 compute instance and everything in between - and they don'...

SQL Injection Vulnerability in ad***.asp of Qixing Helpdesk System Backend

The Kairos Helpdesk System is a system for dealing with day-to-day issues. A SQL injection vulnerability exists in the backend ad.asp of Qixing Helpdesk System, which can be exploited by attackers to manipulate the database...

Vanilla Forums Stored Cross-Site Footer Vulnerability

Vanilla Forums is a Canadian company Vanilla Forums PHP-based open source forum program . A stored cross-site script vulnerability exists in Vanilla Forums. An attacker can exploit this vulnerability to gain access to the backend administrator...

SQL Injection Vulnerability in Sl***_St***.aspx of Bid 1.0 Backend of Qixing Engineering Bidding System

Qixing Bidding System is suitable for enterprises to collect information on government procurement, engineering construction, land grant and other bidding information, and to track the progress of works and payment of successful projects. QiStar Engineering Bidding System Bid 1.0 backend SlSt.asp...

SQL Injection Vulnerability in UsualToolCMS 8.0 Release Backend a_re***.php

UsualToolCMS UTCMS is a content management system and rapid site building framework. UsualToolCMS backend are.php suffers from a sql injection vulnerability, which can be exploited by attackers to manipulate the database...

Arbitrary file deletion vulnerability in emlog v6.0.0 backend b****.php page

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. The emlog v6.0.0 backend b.php page has an arbitrary file deletion vulnerability...

Updated gvfs packages fix security vulnerability

The backend currently allows to access and modify files without prompting for password if any polkit authentication agent isn't available. This affects only users which belong to wheel group i.e. those who are already allowed to use sudo. It doesn't allow privilege escalation for users, who don't...

SUSE SLES15 Security Update : nginx (SUSE-SU-2019:0334-1)

This update for nginx to version 1.14.2 fixes the following issues : Security vulnerabilities addressed : CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. CVE-2018-16845: Fixed an issue which...

SQL Injection Vulnerability in the Backend Us***_Ro***.aspx File of Qixing Image & Video Library Gallery v27.0

Qixing Image & Video GalleryGallery is mainly used to store images or videos in the company. A SQL injection vulnerability exists in the backend UsRo.aspx file of Qixing Image & Video Gallery v27.0, which can be exploited by an attacker to obtain sensitive information from the database...

SUSE-SU-2019:0334-1 Security update for nginx

This update for nginx to version 1.14.2 fixes the following issues: Security vulnerabilities addressed: - CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. - CVE-2018-16845: Fixed an issue whic...

Race condition

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=?php and admin/databack/bakuptables.php?2=fileputcontents URIs because...

Metinfo Competitive Conditions Vulnerability

MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A competitive condition vulnerability exists in MetInfo. An attacker can exploit this vulnerability by means of a competitive condition in the backend database backup function via admin / index.php?n =...

CVE-2019-3827

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running unde...

SQL Injection Vulnerability in eDoc Backend fo***.aspx Page

Electronic document library eDoc is a click document management system developed by Anhui Qixing Studio. Electronic document library eDoc background fo.aspx page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

CVE-2019-7535

index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology...

Attackers Can Track Kids' Locations via Connected Watches

Despite ongoing warnings about connected watches and toys endangering kids’ privacy and potentially their physical safety, makers of these Internet of Things gadgets continue to turn out products that do just that. The latest concern is a gamut of kids’ GPS-tracking watches, which were found to b...