Code Execution Vulnerability in SeaCMS

SeaCM is a web content management system based on PHP+MYSQL architecture and supports cross-platform operation. SeaCMS suffers from a code execution vulnerability that can be exploited by attackers to execute malicious code...

Telos Automated Message Handling System contains multiple vulnerabilities

Overview Telos Automated Message Handling System AMHS contains multiple XSS vulnerabilities and a database information disclosure vulnerability. Description Telos AMHS is a web-based messaging system that supports DoD and Intelligence Community IC security marking requirements. AMHS versions prio...

SonicWall SMA100 SQL Injection Vulnerability

The SonicWall SMA100 is a secure access gateway appliance from SonicWall USA. A SQL injection vulnerability exists in SonicWall SMA100 9.0.0.3 and earlier versions, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an...

CVE-2019-17428

An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted...

SQL Injection Vulnerability in Digital Campus Integrated Management System of Anhui Kexun Education Equipment Co.

Digital campus is based on digital information and network, established on computer and network technology for the collection, processing, integration, storage, transmission and application of campus information on teaching, scientific research, management, technical services, life services, etc....

Code injection

An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service which is typically exposed to all users allows connections to the internal PostgreSQL database of the appliance. By connecting to the database through the proxy without password authentication, an attacker is able to fully...

Forma LMS 2.2.1 /appLms/ajax.server.php filter_cat and filter_status parameters SQL injections

Summary Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing...

Dongguan Yuteng Information Technology Co., Ltd. website building system SQL injection vulnerability

Dongguan Yuteng Information Technology Co., Ltd abbreviation: Yuteng Software is a company specializing in software development, network services and system integration in the field of supply chain and logistics freight forwarding services. There is a SQL injection vulnerability in Dongguan Yuten...

SQL Injection Vulnerability in Website Building System of Shanghai Enterprise Torch Advertising & Media Co.

Shanghai Enterprise Torch Advertising & Media Co., Ltd. is a company dedicated to providing all kinds of enterprises and institutions with information technology services such as network domain name registration, web hosting rental, website construction and maintenance, website promotion and...

GitLab: Steal private objects of other projects via project import

Summary An attacker could transfer issues, merge requests of another project to the imported project by importing a crafted GitLab export. Steps to reproduce 1. Import the attached tarball as GitLab export. 2. Check the issues page of the imported project. You will see an private issue created by...

Code execution vulnerability in SeaCMS backend (CNVD-2019-45346)

SeaCMS is a station building system based on PHP+MYSQL architecture and supports cross-platform operation. A code execution vulnerability exists in the background of SeaCMS, which can be exploited by attackers to execute malicious code...

Information disclosure

Information Disclosure vulnerability in McAfee Advanced Threat Defense ATD prior to 4.8 allows remote authenticated attackers to gain access to the atduser credentials via carefully constructed GET request extracting insecurely information stored in the database...

CVE-2011-4901

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database...

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

Sql injection

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

The vulnerability of the InnoDB component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

DedeCMS backend has SQL injection vulnerability

Dream Content Management System DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the backend of DedeCMS. The vulnerability stems from the lack of validation of externally entered SQL statements in the database-based application, which can be exploite...

YouPHPTube SQL Injection Vulnerability (CNVD-2020-20385)

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in YouPHPTube version 7.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL...

IBM DB2 High Performance Unload load for LUW Buffer Overflow Vulnerability

IBM DB2 is a relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions.High Performance Unload load for LUW is a DB2 utility program. The program can be used to unload DB2 tables fr...

SQL Injection Vulnerability in Kinglun's Website Building System

Wuhan Jinglun Technology Development Co., Ltd. is a company that mainly deals with software development, system integration, digital media marketing and other projects. There is a SQL injection vulnerability in the Jinglun website building system, which can be exploited by attackers to obtain...