Security Advisory - Path Traversal Vulnerability in Some Huawei Products

There is a path traversal vulnerability in some Huawei products. The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly...

Trace Financial CRESTBridge SQL注入漏洞

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A SQL injection vulnerability exists in Trace Financial CRESTBridge versions prior to 6.3.0.02, which stems from a lack of validation of external input SQL statements, which can be exploited by attackers to execute illegal SQL...

NETGEAR R7000 Code Execution Vulnerability

Netgear NETGEAR R7000 is a wireless router from Netgear, Inc. A security vulnerability exists in the NETGEAR R7000 in 1.0.11.116, which stems from a failure of the network system or product to properly filter special elements of the code segment during external input data construction. An attacke...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. eLearning and online course solution WordPress plugin before 1.8.3 suffers from a SQL injection vulnerability that...

D-Link DAP-1860 Remote Code Execution Vulnerability (CNVD-2022-38539)

The D-Link DAP-1860 is a WiFi range extender from D-Link, a Taiwan-based company. A remote code execution vulnerability exists in the D-Link DAP-1860, which stems from a network system or product that does not properly filter external input data during the construction of executable commands, and...

PHPSHE SQL Injection Vulnerability (CNVD-2021-14156)

PHPSHE is a set of online shopping mall system of China Lingbao Jane Hao Network Technology PHPSHE Company. The system supports express tracking, online chat, order evaluation and statistics and other functions. A SQL injection vulnerability exists in PHPSHE, which stems from the lack of validati...

Systeminformation Operating System Command Injection Vulnerability

An operating system command injection vulnerability exists in Systeminformation, which arises when a network system or product fails to properly filter special characters, commands, etc., during the construction of executable operating system commands from externally input data. An attacker could...

OpenEMR SQL注入漏洞

OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A SQL injection vulnerability exists in OpenEMR that stems from a lack of...

LimeSurvey SQL Injection Vulnerability

LimeSurvey formerly known as PHPSurveyor is an open source online survey program from the LimeSurvey Limesurvey team that supports survey program development, survey distribution, and data collection. A SQL injection vulnerability exists in LimeSurvey that stems from a lack of validation of...

CVE-2020-27298

Philips Interventional Workspot Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live Release 1.0, ViewForum Release 6.3V1L10. The software constructs all or part of an OS command using externally influenced input from an upstream component but does no...

Joomla! JVTwitter SQL Injection Vulnerability

Developed by PHP language and MySQL database, Joomla! is a content management system Content Management System, CMS. A SQL injection vulnerability exists in Joomla! The vulnerability stems from a database application that lacks validation of externally entered SQL statements. An attacker can...

Path traversal

Path Traversal vulnerability in McAfee McAfee Email Gateway MEG prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory...

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

The DCS-2530L and DCS-2670L are Full HD 180-degree Wi-Fi cameras from D-Link. A command injection vulnerability exists in cgi-bin/ddnsenc.cgi in the D-Link DCS-2530L and DCS-2670L. The vulnerability stems from a network system or product not properly filtering specific elements of externally...

Travel Management System SQL Injection Vulnerability

Travel Management System is a travel management system. Travel Management System suffers from a SQL injection vulnerability that arises from a database application that lacks validation of externally entered SQL statements. An attacker could exploit this vulnerability to execute illegal SQL...

Red Hat CloudForms OS Command Injection Vulnerability

Red Hat CloudForms is a hybrid infrastructure management platform from Red Hat, Inc. The platform provides deployment, management, and other capabilities across virtual machines, clouds, containers, and physical infrastructure. An operating system command injection vulnerability exists in Red Hat...

Joomla! J2 JOBS SQL Injection Vulnerability

Joomla! is an open source, cross-platform content management system CMS developed using PHP and MySQL. A SQL injection vulnerability exists in Joomla! J2 JOBS. The vulnerability stems from a database application that lacks validation of externally entered SQL statements. An attacker can exploit t...

Pi-hole Code Injection Vulnerability

Pi-hole is a web-grade ad-blocking application from Pi-hole. A code injection vulnerability exists in piholedhcp in Pi-hole 5.0 and prior versions. The vulnerability stems from a network system or product not properly filtering specific elements of the code segment constructed from external input...

ArticaTech Artica Proxy Operating System Command Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. An operating system command injection vulnerability exists in versions prior to ArticaTech Artica Proxy 4.30.000000 Community Edition. The vulnerability arises from a network system or product not...

Limdu Operating System Command Injection Vulnerability

Limdu is a machine learning framework for Node.js by Erel Segal-Halevi Software Developers. An operating system command injection vulnerability exists in the 'trainBatch' function in versions of Limdu prior to 0.95. The vulnerability stems from a network system or product not properly filtering...

Jason2605 AdminPanel SQL Injection Vulnerability

Jason2605 AdminPanel is a database administration panel. Jason2605 AdminPanel suffers from a SQL injection vulnerability. The vulnerability stems from a database-based application that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...