concrete5 'Access.php' SQL Injection Vulnerability

concrete5 is a free content management system CMS developed by Portland Labs in the United States. The system allows editing and layout directly on the page. A SQL injection vulnerability exists in concrete5 that stems from the program failing to adequately filter user-submitted input before...

Authentication flaw

Aptexx Resident Anywhere does not require authentication, which allows remote attackers to obtain sensitive information or modify data via a direct request...

CVE-2014-4882

CVE-2014-4882 affects Aptexx Resident Anywhere. The vulnerability is an authentication bypass where an unauthenticated remote attacker can access or modify data via a direct account URL, potentially exposing user name, contact, and payment-related information. CERT/CC details indicate sensitive d...

TickFa SQL Injection Vulnerability

TickFa is an online customer support system. TickFa suffers from a SQL injection vulnerability due to the failure of the program's ticket.php script to correctly 'tid' parameter input, which allows remote attackers to exploit the vulnerability by submitting a specially crafted SQL query to...

Samsung Galaxy S Mobile Phone Remote Code Execution Vulnerability

Samsung Galaxy is a series of mid-range and high-end smartphones from Samsung.Swiftkey keyboard is a keyboard application that comes pre-installed with system privileges on Galaxy S series phones. Samsung Galaxy S4 Mini, S4, S5, S6 series smartphones fail to validate Swiftkey language pack...

CVE-2015-4190

Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683...

Code injection

Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683...

CVE-2015-4190

CVE-2015-4190 affects Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances. The root cause is a design flaw/default host keys that enable a man-in-the-middle attack, allowing an unauthenticated remote attacker to modify data during login or data exchange via u...

CVE-2015-4190

Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683...

Cisco Cloud Portal Default SSH HOST Key Man-in-the-Middle Attack Vulnerability

Cisco Cloud Portal is a cloud portal for data center services. Cisco Cloud Portal has a security vulnerability due to the system using a default host key for SSH communication. A remote attacker could modify the target system data through a man-in-the-middle attack...

IBM Marketing Operations Arbitrary File Upload Vulnerability

IBM Marketing Operations formerly known as IBM Unica Marketing Operations is a suite of marketing management software from the American company IBM. The software supports streamlining of production processes, tracking of budgets and expenditures, and improved teamwork. IBM Marketing Operations...

Design/Logic Flaw

IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x before 9.1.1.2 allows remote authenticated users to upload arbitrary GIFAR files, and consequently modify data, via unspecified vectors...

CVE-2014-8887

CVE-2014-8887 affects IBM Marketing Operations 7.x/8.x (before 8.5.0.7.2), 8.6.x (before 8.6.0.8), 9.0.x (before 9.0.0.4.1), 9.1.0.x (before 9.1.0.5), and 9.1.1.x (before 9.1.1.2). A remote authenticated attacker can upload arbitrary GIFAR files and modify data via unspecified vectors. The root c...

IBM Security SiteProtector System SQL Injection Vulnerability

The IBM Security SiteProtector System is a centralized management system that unifies the management and analysis of network, server and endpoint security agents and devices. A SQL injection vulnerability exists in IBM Security SiteProtector System, which allows remote attackers to exploit the...

Multiple SQL Injection Vulnerabilities in WordPress GigPress Plugin 'handlers.php'

WordPress is a blogging platform developed using the PHP language that allows users to set up their own weblogs on servers that support PHP and MySQL databases.GigPress is a real-time gig listing and management plugin for musicians and other performers. Multiple SQL injection vulnerabilities exis...

WordPress Wp Image Zoom Plugin - SQL Injection

Because of this vulnerability, attackers can compromise the application, access or modify data. zoom.php id parameter is vulnerable. Solution Update plugin...

Nodes Studio CMS Information Disclosure Vulnerability

Nodes Studio CMS is a content management system. Nodes Studio CMS has an unspecified security vulnerability that allows remote attackers to obtain sensitive cookie information, take control of the application, and access or modify data...

KPPW最新版SQL注入漏洞，修补不严

简要描述： KPPW最新版SQL注入漏洞，修补不严 详细说明： 1.看了http://wooyun.org/bugs/wooyun-2010-086216。这篇帖子，正巧也在审计KPPW，也就去看了用一下最新版对于爆出问题的修补方式。最新版为了防止该漏洞，添加了一个验证。 if$gUserInfo'uid' != $pk'uid' kekezu::showmsg'无权操作',NULL,NULL,NULL,'error'; return false; 2.$gUserInfo'uid'是用户id，是我们不可控的。所以这里不能再用xfkxfk大牛的方法构造uid了。那么我们再看一下save函...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The vulnerability of the libuno-cli-cppuhelper1.0-cil package within the office software suite OpenOffice is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libxml2-devel-2.4.19 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...