CVE-2019-17235

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure...

Adobe ColdFusion File Upload (APSB18-33) (CVE-2018-15961)

An arbitrary file upload vulnerability exists in Adobe ColdFusion due to insufficient validation in the filemanager plugin. An unauthenticated, remote attacker can exploit this, via a specially crafted POST request, to upload arbitrary files on the remote host. TRUSTED...

bangkok.immigration.go.th Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-928873 Security Researcher KhanJanny Helped patch 3055 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting bangkok.immigration.go.th...

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

Code injection

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

CVE-2018-20952

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor SEC-388...

CVE-2018-20952

CVE-2018-20952 affects cPanel prior to 68.0.27. The issue involves world-readable files created during use of the WHM Apache Includes Editor (SEC-388). The public description confirms the vulnerable state; no exploitation details are provided in the supplied documents. Remediation appears to be u...

GHSA-JJPQ-GP5Q-8Q6W Cross-site scripting in Apache Tomcat

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

DEBIAN-CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

Chrome V8 Turbofan JSCallReducer::ReduceArrayIndexOfIncludes Failed Check

v8: turbofan: JSCallReducer::ReduceArrayIndexOfIncludes fails to insert Map checks Since commit https://chromium.googlesource.com/v8/v8.git/+/c22bb466d8934685d897708119543d099b9d2a9a turbofan supports inlining calls to array.includes and array.indexOf. The logic of the function is roughly: 1. Che...

CVE-2018-20434 - LibreNMS Addhost Command Injection

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

ZoneMinder Cross-Site Scripting Vulnerability (CNVD-2019-04686)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras and more. A cross-site scripting vulnerability exists in the build of SQL-ERR messages in the includes/database.php file of ZoneMinder versions prior to 1.32.3, which can be exploited b...

ZoneMinder Command Injection Vulnerability

ZoneMinder is a free and open source CCTV software application for Linux environments that supports IP, USB and analog cameras. A command injection vulnerability exists in ZoneMinder prior to version 1.32.3 in the daemonControl in includes/functions.php, which can be exploited by an attacker via...

UBUNTU-CVE-2019-8427

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...

DEBIAN-CVE-2019-8427

daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...

The vulnerability of the Squid proxy server, related to accessing beyond the allocated buffer memory, allows attackers to cause a service failure.

The vulnerability of the Squid proxy server is related to an error that causes data to exceed the allocated memory buffer when processing ESI responses or loading certificates from intermediate certification centers. Exploiting this vulnerability can allow a malicious actor to cause service...

Object Injection

wordpress is vulnerable to PHP object injection. The vulnerability exists in the wpgetattachmentthumbfile function in wp-includes/post.php because the attack can be triggered by inputting manipulated metadata. in the wpgetattachmentthumbfile function in wp-includes/post.php...

CVE-2018-18803

Curriculum Evaluation System 1.0 allows SQL Injection via the login screen, related to frmCourse.vb and includes/user.vb...

CVE-2018-18803

CVE-2018-18803 corresponds to a SQL Injection in Curriculum Evaluation System 1.0, exploitable via the login screen. Technical details in connected records show the vulnerability stems from building SQL queries by string concatenation in code paths (e.g., frmCourse.vb and includes/user.vb), enabl...