CVE-2020-18013

SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?adminbanned/add.htm...

SourceCodester E-Commerce Website Cross-Site Scripting Vulnerability

SourceCodester E-Commerce Website is an application. A PHP e-commerce website project for bookstores. SourceCodester E-Commerce Website v 1.0 is vulnerable to a cross-site scripting vulnerability that could be exploited to inject arbitrary web script or HTM into feedbackprocess.php via the subjec...

CVE-2020-23574

Sysax Multi Server 6.90 is affected. An authenticated user can modify the filename="" parameter in the uploadfile_name1.htm upload form to reach 368+ bytes, triggering a buffer overflow that causes the application to crash. Root cause is a overflow in handling long filenames during file upload. N...

SQL Injection Vulnerability in Co***.htm Page of Home Furnishing ERP Management System of Shanghai Furnishing Union Information Technology Co.

Ltd. is a software service company specializing in enterprise management solutions for the decoration industry. Ltd. home decoration ERP management system Co.htm page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL injection vulnerability in do***.htm page of cross-border e-commerce integrated platform of Shenzhen Hualei Logistics Information Technology Co.

Ltd. is an information technology service provider. Ltd. cross-border e-commerce integrated platform do.htm page SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

CVE-2020-8798

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

Design/Logic Flaw

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

CVE-2020-8798

httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network...

CVE-2020-11542

3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the MYKEY substring...

Parallels Plesk Panel Cross-Site Scripting Vulnerability (CNVD-2020-41525)

Parallels Plesk Panel is a control panel for the Plesk web hosting platform from Parallels USA. A cross-site scripting vulnerability exists in Parallels Plesk Panel version 9.5 in target/locales/tr-TR/help/index.htm? that can be exploited to inject JavaScript via the "fileName" parameter...

Astaroth Spy Trojan Uses Facebook, YouTube Profiles to Cover Tracks

Facebook and YouTube profiles are at the heart of an ongoing phishing campaign spreading the Astaroth trojan, bent on the eventual exfiltration of sensitive information. The attack is sophisticated in that it uses normally trusted sources as cover for malicious activities – thus evading usually...

CVE-2015-9340

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files...

CVE-2018-13308

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field...

Kernel: KVM: oops when checking KVM_CAP_PPC_HTM on PPC platform

The kvmvmioctlcheckextension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash via a KVMCHECKEXTENSION KVMCAPPPCHTM ioctl call to /dev/kvm...

Linux kernel local denial of service vulnerability (CNVD-2017-33480)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A local denial of service vulnerability exists in the 'kvmvmioctlcheckextension' function in the arch/powerpc/kvm/powerpc.c file in versions of the Linux kernel prior ...

CVE-2017-9544

There is a remote stack-based buffer overflow SEH in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. By sending an overly long username string to registresult.htm for registering the user, an attacker may be able to execute arbitrary code...

openSUSE Security Update : gcc5 (openSUSE-2016-472)

The GNU Compiler Collection was updated to version 5.3.1, which brings several fixes and enhancements. The following security issue has been fixed : - Fix C++11 std::randomdevice short read issue that could lead to predictable randomness. CVE-2015-5276, bsc945842 The following non-security issues...

迅雷权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

迅雷极速版权限提升漏洞

迅雷下载东西的时候，会调用我们安装迅雷后一个htm文件，去激活htm文件里的一些代码， 把我们所下载东西添加到列表当中。 所对应的htm文件有2处： C:\Program Files\Thunder Network\Thunder\Program\geturl.htm C:\Program Files\Thunder Network\Thunder\Program\getAllurl.htm 如果我们想把我们想要的代码添加进去执行了？ 我们简单写个代码试试，代码如下： Set vbs=CreateObject"Wscript.Shell" vbs.run "cmd /c net user...

CyberBuild 0 browse0.htm ProductIndex Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/17829/info CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly...