douniamp3.co Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1144341 Security Researcher 1orzero Helped patch 100 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting douniamp3.co website and its users. Following coordinat...

CVE-2020-10507

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload RCE , that would allow attackers to gain access in the hosting machine...

CVE-2020-10506

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files...

Sql injection

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based injection query string to get databases schema and username/password...

Path traversal

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files...

Unrestricted file upload

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload RCE , that would allow attackers to gain access in the hosting machine...

CVE-2020-10507 ALLE INFORMATION CO., LTD. School Manage System - Security Misconfiguration

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload RCE , that would allow attackers to gain access in the hosting machine...

CVE-2020-10507

CVE-2020-10507 concerns the ALLE INFORMATION CO., LTD. School Manage System (before 2020). The issue is an Unrestricted file upload vulnerability that can lead to remote code execution on the hosting machine. Root cause: misconfiguration of the file upload filter in the system (as noted in CNVD-2...

CVE-2020-10506 ALLE INFORMATION CO., LTD. School Manage System - Path Traversal

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files...

CVE-2020-10505 ALLE INFORMATION CO., LTD. School Manage System - SQL Injection

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based injection query string to get databases schema and username/password...

CVE-2020-10506

CVE-2020-10506 affects the School Manage System (before 2020) by ALLE INFORMATION CO., LTD. The vulnerability is a Path Traversal flaw that allows an attacker to access arbitrary files. The NVD entry lists a CVSSv3 base score of 7.5 (HIGH) , with network attack vector and no privileges required, ...

CVE-2020-10505

Summary (CVE-2020-10505): The School Manage System by ALLE INFORMATION CO., LTD. prior to 2020 contains an SQL Injection vulnerability that can be exploited via a union-based query to disclose database schema and credentials (username/password). Affected component: the School Manage System’s SQL ...

CVE-2018-1002105

A privilege escalation vulnerability exists in OpenShift Container Platform which allows for compromise of pods running co-located on a compute node. This access could include access to all secrets, pods, environment variables, running pod/container processes, and persistent volumes, including in...

JVN#89224521: Multiple vulnerabilities in EasyBlocks IPv6

EasyBlocks IPv6 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below. Cross site request forgeryCWE-352 - CVE-2020-5549 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base...

Important: openssl

Issue Overview: Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters instead of using a named curve. In those cases it is possible that such a grou...

SQL Injection Vulnerability in Co***.cl***.php File of Worry-free PHP Enterprise Website Management System

Hassle-free PHP enterprise website management system is developed using PHP+MYSQL technology and MVC model, with clear architecture and easy-to-maintain code. A SQL injection vulnerability exists in the Co.cl.php file of the Worry-Free PHP Enterprise Website Management System, which can be...

CVE-2019-3696

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise...

JVN#19666251: Multiple vulnerabilities in OpenBlocks IoT VX2

OpenBlocks IoT VX2 provided by Plat'Home Co., Ltd. contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2020-5535 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2| AV:A/AC:L/Au:N/C:P/I:P/A:P| Base Score:...

Command Execution Vulnerability in eyoucms of Hainan Zanzan Network Technology Co.

EyouCms is a free + open source enterprise content management system based on the TP5.0 framework as the core development, focusing on the needs of enterprise building users. Hainan Zanzan Network Technology Co. eyoucms has a command execution vulnerability that can be exploited by attackers to...

UBUNTU-CVE-2020-6062

An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A specially crafted HTTP POST request can lead to server crash and denial of service. An attacker needs to send an HTTP request to trigger this vulnerability...