Intel Media Server Studio - Improper Directory Permissions

Document Title: =============== Intel Media Server Studio - Improper Directory Permissions References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2170 Security ID:: INTEL-SA-00197 https://nvd.nist.gov/vuln/detail/CVE-2018-3697...

CVE-2018-19296

PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack...

CVE-2018-3885

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger thes...

CVE-2018-3884

An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sortby and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to...

WUZHI CMS SQL Injection Vulnerability (CNVD-2018-18142)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in the /coreframe/app/admin/pay/admin/index.php file in WUZHI CMS version 4.1.0. A remote attacker can exploit this...

New Man-in-the-Disk attack leaves millions of Android phones vulnerable

Security researchers at Check Point Software Technologies have discovered a new attack vector against the Android operating system that could potentially allow attackers to silently infect your smartphones with malicious apps or launch denial of service attacks. Dubbed Man-in-the-Disk , the attac...

Cross site scripting

Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

MGASA-2018-0279 Updated leptonica packages fix security vulnerabilities

This update fixes a security issue potential injection attack using gplot rootdir originally reported in CVE-2018-3836. This fix was incomplete and again reported in CVE-2018-7440 and CVE-2018-7442. The improved fix is included in leptonica-1.76.0...

The vulnerability of the web portal for managing the Ericsson-LG iPECS NMS allows a hacker to bypass authentication procedures and execute arbitrary code.

The vulnerability of the Ericsson-LG iPECS NMS network management portal is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and execute arbitrary code using parameters “id” and...

Wecodex Store Paypal SQL Injection Vulnerability

Wecodex Store Paypal is a management system. A SQL injection vulnerability exists in Wecodex Store Paypal. An attacker can exploit the vulnerability to obtain sensitive information...

CVE-2018-10825

Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy BLE communication from a Turtle to a Lilypad, which allows attackers to inject fake information about the position and temperature of a baby via a replay or spoofing attack...

SQL Injection Vulnerability in Cloud EC E-commerce System at Front-end User Comments

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of PHP + MYSQL-based open source e-commerce system software developed independently by Cloud MYSQL e-commerce Co. Cloud EC e-commerce system SQL injection vulnerability exists in the front-end user comments. Attackers can use...

CVE-2018-9846

In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "uid" parameter in an archive.php task=mail&mbox=INBOX&action=plugin.move2archive request to perform an MX IMAP injection attack by placing an IMAP...

CVE-2018-1096

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database...

CVE-2018-1096

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database...

SQL injection vulnerability in news_show.asp page of Chengdu Firefox Technology Co.

Chengdu Firefox Technology Co., Ltd. is a set of research, promotion and development of new technology areas of the network, mainly dedicated to the enterprise information technology services of the network company. There is a SQL injection vulnerability in the newsshow.asp page of Chengdu Firefo...

Dongguan Lightspeed Network Technology Co., Ltd. website building system has SQL injection vulnerabilities

Dongguan Lightspeed Networks specializes in providing website design services for the majority of small and medium-sized enterprises, government agencies and so on. Dongguan Lightspeed Network Technology Co., Ltd. website building system has SQL injection vulnerability, attackers can use the...

MGASA-2018-0154 Updated leptonica packages fix a security vulnerability

Package leptonica has been updated to the current stable version 1.75.2 which fixes a security issue potential injection attack using gplot rootdir reported in CVE-2018-3836...

Updated leptonica packages fix a security vulnerability

Package leptonica has been updated to the current stable version 1.75.2 which fixes a security issue potential injection attack using gplot rootdir reported in CVE-2018-3836...

USN-3584-1: sensible-utils vulnerability

Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker could possibly use this issue with a specially crafted URL to conduct an argument injection attack and execute arbitrary code...