CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

Apple Security Update: Apple TV Software 7.4

Apple recommends to install security update Apple TV Software 7.4 on devices Apple TV 3rd generation...

CVE-2019-16656

joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database...

CVE-2019-16655

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available...

CVE-2019-16655

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available...

Authentication flaw

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available...

CVE-2019-16655

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available...

CVE-2019-16655

CVE-2019-16655 affects joyplus-cms 1.6.0 and allows reinstallation if the install/ URI remains accessible. Connected sources (Red Hat, NVD, CVE records) confirm the same description across multiple entries. The available documents do not provide a formal root-cause analysis, exploitation details,...

CVE-2019-16656

Joyplus-cms 1.6.0 is vulnerable to remote code execution via /install by placing PHP code in the name of a database object. Root cause: unsafe handling of object-name data allows execution of arbitrary PHP on the server. Impact is described as high/critical (CVSS v3.1: 9.8, NETWORK, NONE privileg...

CVE-2019-16655: Undefined Security Weakness

joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available...

CVE-2019-16656: Undefined Security Weakness

joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database...

PT-2019-14740

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for reinstallation if the install/ URI remains available. Recommendations For joyplus-cms version 1.6.0, restrict access to the install/ URI to prevent reinstallation...

PT-2019-14741

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by accessing the /install API endpoint and placing the malicious code in the name of an object in the database...

Indexhibit Reinstallation Vulnerability

Indexhibit is a content management system CMS. A security vulnerability exists in Indexhibit version 2.1.5. The vulnerability can be exploited by an attacker to execute code via /ndxzstudio/install.php?p=2...

EulerOS 2.0 SP5 : libosinfo (EulerOS-SA-2019-1888)

According to the version of the libosinfo package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations, 'osinfo-install-script', accepts user and admin...

Stegify - Go Tool For LSB Steganography, Capable Of Hiding Any File Within An Image

stegify is a simple command line tool capable of fully transparent hiding any file within an image. This technique is known as LSB Least Significant Bit steganography. Demonstration Carrier Data Results The Result file contains the Data file hidden in it. And as you can see it is fully transparen...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

Path traversal

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

CVE-2019-5484

CVE-2019-5484 – Bower path traversal . Affects Bower up to version 1.8.7; older releases permit writing files to arbitrary locations during extraction of a malicious package via the install command. Root cause is improper validation of extracted paths, enabling directory traversal and arbitrary f...