CVE-2018-9922

An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname...

Code Execution Vulnerability in Gxlcms News System DataAction.class.php

Gxlcms News System is a news cms content management system developed in php+mysql. A code execution vulnerability exists in DataAction.class.php of Gxlcms News System. An attacker can exploit the vulnerability to obtain a webshell...

SQL Injection Vulnerability in Gxlcms News System AdsAction.class.php

Gxlcms News System is a news cms content management system developed in php+mysql. A SQL injection vulnerability exists in Gxlcms News System AdsAction.class.php. An attacker can exploit the vulnerability to obtain sensitive database information...

Directory traversal

In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request...

GxlcmsQY Arbitrary PHP Code Execution Vulnerability

GxlcmsQY system is a quick website cms tailored for business users. An arbitrary PHP code execution vulnerability exists in the upload function in LibLibActionAdminUploadAction.class.php in GxlcmsQY v1.0.0713. A remote attacker can exploit this vulnerability by first changing the configuploadclas...

Gxlcms QY Information Disclosure Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the Lib\Lib\Action\Home\HitsAction.class.php file in Gxlcms QY version 1.0.0713. The vulnerability can be exploited by a remote attacker to read data from the database by injecting FROM clauses into the query...

Gxlcms QY Arbitrary File Read Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the Lib\Lib\Action\Admin\TplAction.class.php file in Gxlcms QY version 1.0.0713. The vulnerability can be exploited by a remote attacker to read arbitrary files with the help of a changed pathname in an Admin-T...

GxlcmsQY update function arbitrary PHP code execution vulnerability

GxlcmsQY system is a quick website cms tailored for business users. An arbitrary PHP code execution vulnerability exists in the update function in LibLibActionAdminTplAction.class.php in Gxlcms QY v1.0.0713. A remote attacker can exploit this vulnerability by placing code in a template to execute...

Arbitrary File Read Vulnerability in GxlcmsQY System

GxlcmsQY system is a simple program tailored for business users. GxlcmsQY System\Lib\Lib\Action\Admin\DataAction.class.php contains an arbitrary file reading vulnerability. An attacker can exploit the vulnerability to read arbitrary files and obtain sensitive information...

Directory Traversal Vulnerability in GxlcmsQY System

GxlcmsQY system is a simple program tailored for business users. A directory traversal vulnerability exists in GxlcmsQY System\Lib\Lib\Action\Admin\PicAction.class.php. An attacker can exploit this vulnerability to obtain sensitive information...

CVE-2018-9848

In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using an Admin-Admin-Configsave request to change the configuploadclass value from jpg,gif,png,jpeg to jpg,gif,png,jpeg,php and then making an...

CVE-2018-9145

In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the...

GxlcmsQY Arbitrary PHP Code Execution Vulnerability

Gxlcms QY is an enterprise website creation system. A security vulnerability exists in the 'upsql' function in the \Lib\Lib\Action\Admin\DataAction.class.php file in Gxlcms QY version 1.0.0713. A remote attacker can exploit this vulnerability by executing arbitrary SQL statements with the help of...

CVE-2018-4140

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Telephony" component. It allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a Class 0 SMS message...

CVE-2018-4140

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Telephony" component. It allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a Class 0 SMS message...

MetaIO SDK for Android Arbitrary Code Execution Vulnerability

MetaIO SDK for Android is a software development kit for building augmented reality applications based on the Android platform. A security vulnerability exists in versions of MetaIO SDK for Android prior to 6.0.2.1. The vulnerability can be exploited to execute arbitrary code via the finalize...

GraceNote GNSDK SDK for Android Arbitrary Code Execution Vulnerability

GraceNote GNSDK SDK for Android is a software development kit for building music applications based on the Android platform that recognizes CDs, digital music files, streaming audio, and more. A security vulnerability exists in versions of GraceNote GNSDK SDK for Android prior to 1.1.7. An attack...

Jumio SDK for Android Arbitrary Code Execution Vulnerability

Jumio SDK for Android is a software development kit for building authentication applications using biometrics based on the Android platform. A security vulnerability exists in versions of Jumio SDK for Android prior to 1.5.0. The vulnerability can be exploited to execute arbitrary code via the...

CVE-2018-9145

In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the...

CVE-2018-9145

In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the...