DEBIAN-CVE-2019-6461

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c...

direction-x.com XSS vulnerability

Open Bug Bounty ID: OBB-679832 Description| Value ---|--- Affected Website:| direction-x.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Unbreakable Enterprise kernel security update

2.6.39-400.300.2 - Revert 'RDS: don't commit to queue till transport connection is up' Santosh Shilimkar Orabug: 27619034 - KVM: Fix stack-out-of-bounds read in writemmio Wanpeng Li Orabug: 27951293 CVE-2017-17741 CVE-2017-17741 - kernel/exit.c: avoid undefined behaviour when calling wait4...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)

The remote OracleVM system is missing necessary patches to address critical security updates : - dm: fix race between dmgetfromkobject and dmdestroy Hou Tao CVE-2017-18203 - drm: udl: Properly check framebuffer mmap offsets Greg Kroah-Hartman Orabug: 27986407 CVE-2018-8781 - kernel/exit.c: avoid...

PvPGN Stats SQL Injection Vulnerability (CNVD-2018-14337)

PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program failing to filter...

CVE-2017-18290

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sortdirection parameter...

PT-2018-6808

Name of the Vulnerable Software and Affected Versions: PvPGN Stats version 2.4.6 Description: A SQL Injection issue exists in the ladder/stats.php file via the sort direction parameter. This allows for potential exploitation. Recommendations: For PvPGN Stats version 2.4.6, consider restricting...

CVE-2014-9989: Improper Validation of Array Index

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, and SD 450, ...

PT-2018-4643

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.7.2 dotCMS versions 4.x prior to 4.1.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the EXT STRUCTURE direction parameter in the "Content...

CVE-2018-5980

SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action...

Sql injection

SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action...

PT-2018-17266

Name of the Vulnerable Software and Affected Versions: Solidres version 2.5.1 Description: A SQL Injection issue exists in the Solidres component for Joomla, specifically via the direction parameter in a "hub.search" action. Recommendations: For Solidres version 2.5.1, update to a newer version...

CVE-2018-5980: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action...

CVE-2018-6889

TypeSetter CMS 5.1 is affected by a Host header injection vulnerability. The root cause is improper handling of the Host header, enabling attackers to poison web caches, execute advanced password-reset attacks, and trigger arbitrary user redirection. Public disclosures and PoCs in connected sourc...

PT-2018-17804

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description An issue was discovered in Typesetter, which suffers from a Host header injection vulnerability. This allows a malicious user to poison the web cache, perform advanced password reset attacks, or trigger...

CVE-2018-6889: Improper Control of Generation of Code

An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger arbitrary user re-direction...

Wonder CMS 2.3.1 - Host Header Injection

Wonder CMS 2.3.1 - Host Header Injection Exploit Title: Wonder CMS 2.3.1 Host Header Injection Date: 30-01-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://www.wondercms.com/ Version: 2.3.1 CVE :...

Oracle Linux 7 : tcpdump (ELSA-2017-1871)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-1871 advisory. 14:4.9.0-5 - Resolves: 1441597; use bigger capture buffer than in upstream 14:4.9.0-4 - Drop downstream patch drop root privileges - Add libcap-ng as a...

PT-2017-18831

Name of the Vulnerable Software and Affected Versions Open Ticket Request System OTRS versions prior to 3.3.20 Description The issue concerns a Cross-Site Scripting XSS attack. Specifically, it affects index.pl requests with the Action=AgentStats parameter. The vulnerability can be exploited...

CVE-2017-9299: Improper Neutralization of Input During Web Page Generation

Open Ticket Request System OTRS 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=XSS and Direction=XSS attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release, for example, is n...