CVE-2016-7069

An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to th...

CVE-2016-7069

An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to th...

Frappe ERPNext SQL Injection Vulnerability

Frappe ERPNext is an open source ERP Enterprise Resource Planning system. The system includes functions for financial management, inventory management, customer relationship management, project management and human resource management. A SQL injection vulnerability exists in the 'sortby' paramete...

phpMyFAQ <= 2.9.10 Multiple Vulnerabilities

phpMyFAQ is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if description...

Design/Logic Flaw

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...

CVE-2018-16651

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...

CVE-2018-16651

The CVE-2018-16651 entry applies to phpMyFAQ (admin backend) before version 2.9.11, where CSV injection in reports is possible due to insufficient sanitization of report content. The vulnerability is reflected with a HIGH CVSS score (3.0: 7.2; 2.0: 9.0) and can impact multiple CIA aspects as defi...

CVE-2018-16651

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...

phpMyFAQ Cross-Site Request Forgery Vulnerability (CNVD-2019-07200)

phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site request forgery vulnerability exists...

phpMyFAQ CSV Injection Vulnerability

phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A CSV injection vulnerability exists in the admin...

SQL Injection Vulnerability in UsualToolCMS Backend

UsualToolCMS is an enterprise-level web content management system written in PHP+MYSQL using template separation technology. UsualToolCMS v8.0 Release suffers from a SQL injection vulnerability in the backend, the vulnerability stems from the program failing to filter parameters, which can be...

SUSE SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2555-1)

This update for libzypp, zypper provides the following fixes : libzypp security fixes : CVE-2018-7685: Validate RPMs before caching bsc1091624, bsc1088705 CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check...

Red Hat Satellite Spoofing Vulnerability

Red Hat Satellite is a suite of system management platforms from Red Hat, Inc. that can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in Red Hat Satellite version 5, which stem...

Arbitrary File Deletion Vulnerability in MLECMS Backend

MLECMS is a professional website building system based on PHP+MYSQL as the core development. There is an arbitrary file deletion vulnerability in the MLECMS backend. An attacker can exploit the vulnerability to delete arbitrary files...

Arbitrary File Deletion Vulnerability in CSCMS V4.1.0 Backend

CSCMS is a multi-functional network information management system developed by Chongsheng Network Technology, which uses PHP5+MYSQL as the technical basis for development. Using OOP object-oriented approach to build the basic operating framework. CSCMS V4.1.0 there are arbitrary file deletion...

Code Execution Vulnerability in the Backend of Feifei Movie Navigation System

FeiFei Film and TV Navigation System FeiFeiCms is a free and open source PHP movie program. A code execution vulnerability exists in the background of FeiFeiCms. An attacker can exploit the vulnerability to execute arbitrary code...

Arbitrary File Deletion Vulnerability in PHPMyWind Backend Database Management System

PHPMyWind is a PHP+MySQL based, W3C compliant website building engine for enterprise level website building. An arbitrary file deletion vulnerability exists in the PHPMyWind backend database management. An attacker can exploit the vulnerability to delete arbitrary files...

dpdk: Information exposure in unchecked guest physical to host virtual address translations

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory...

New Relic: [NR Insights] Pull any Insights/NRQL data from any NR account

@jonbottarini discovered an issue where a feature within a cloud integration wasn't properly validating account IDs. This report helped us identify a backend issue that could prevent account validation from taking place in certain situations. This was a fun one! The full writeup is for this bug i...

Cookie Spoofing Vulnerability in Website Building System of Henan Yipug Computer Technology Co.

Henan Yipug Computer Technology Co., Ltd. is a service organization that focuses on enterprise network marketing landing. Ltd. building system there is a cookie deception vulnerability, the attacker has been verified through the success of the cookie, the use of loopholes without authentication t...