8809 matches found
May 8, 2018—KB4103723 (OS Build 14393.2248) - EXPIRED
None None...
SQL Injection Vulnerability in Cloud EC E-commerce System at Front-end User Comments
Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists in the front-end user comments. Attackers can use...
Cloud EC e-commerce system SQL injection vulnerability in the foreground
Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists in the frontend. Attackers can use the...
SQL Injection Vulnerability in Cloud EC E-commerce System at Front-end Order Evaluations
Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists at the front-end order evaluation. Attackers can...
php: Use after free in wddx_deserialize
Use-after-free vulnerability in the wddxstackdestroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field...
First things first: Envisioning your security deployment
This blog post is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog...
CVE-2017-1722
IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 134811...
Use the password reset functions to achieve account-hijacking-vulnerability warning-the black bar safety net
Recently, I attended a platform to invite vulnerability testing project, in which the discovery of a unique account hijacking vulnerability, the entire vulnerability discovery process very unexpected but also very lucky, by the password reset function can be achieved account hijacking, and I will...
October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting
Exploit Title: October CMS User Plugin v1.4.5 - Persistent Cross-Site Scripting Date: 2018-04-03 Author: 0xB9 Software Link: https://octobercms.com/plugin/rainlab-user Version: 1.4.5 Tested on: Ubuntu 17.10 CVE: CVE-2018-10366 1. Description: Front-end user management for October CMS. Allows...
Design/Logic Flaw
An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...
Mediawiki End of Life (EOL) Detection - Linux
The Mediawiki version on the remote host has reached the end of life EOL and should not be used anymore. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
CVE-2018-1289
In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' and 'sortOrder' which are appended directly with SQL statements. A hacker/user can inject/draft...
CVE-2018-0238
A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...
CVE-2018-0238
CVE-2018-0238 affects Cisco UCS Director; an attacker can log in with a modified username and valid password to gain visibility into and perform actions on any VM in the end-user portal. Root cause: improper user authentication checks in role-based resource checking; impact includes information d...
Cisco UCS Director Virtual Machine Information Disclosure Vulnerability for End User Portal
A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System UCS Director could allow an authenticated, remote attacker to view unauthorized information for any virtual machine in the UCS Director end-user portal and perform any permitted operations on a...
Cross-site scripting (XSS) vulnerability in the system log of the back end
More info at https://contao.org/en/news/contao-3535.html...
Cross-site scripting (XSS) vulnerability in the system log of the back end
More info at https://contao.org/en/news/contao-4418.html...
Cross-site scripting (XSS) vulnerability in the system log of the back end
More info at https://contao.org/en/news/contao-4418.html...
MS09-012: Vulnerabilities in Windows could allow elevation of privilege
Resolves vulnerabilities in Windows that could allow elevation of privilege if an attacker is allowed to log on to the system and then run a specially crafted application.Support for Windows Vista Service Pack 1 SP1 ends on July 12, 2011. To continue receiving security updates for Windows, make...