CVE-2018-17034

UCMS 1.4.6 contains a Cross-Site Scripting (XSS) vulnerability controllable via the mysql_dbname parameter in install/index.php. Multiple connected sources (NVD entry CVE-2018-17034 and CNVD/CVE listings) confirm an XSS flaw capable of injecting arbitrary scripts/HTML in affected users’ browsers....

CVE-2018-17035

The vulnerability CVE-2018-17035 affects UCMS 1.4.6, where an SQL injection can occur during installation via the install/index.php mysql_dbname parameter. Affected component is UCMS (PHP-based CMS); root cause is unsafely handled mysql_dbname input during setup, enabling potential SQL command ex...

UCMS SQL Injection Vulnerability

UCMS is a content management system written in PHP. A SQL injection vulnerability exists in the install/index.php file in UCMS version 1.4.6. A remote attacker can exploit this vulnerability to execute SQL commands with the help of the 'mysqldbname' parameter...

UCMS PHP Code Injection Vulnerability

UCMS is a content management system written in PHP. A security vulnerability exists in the install/index.php file in UCMS version 1.4.6. The vulnerability can be exploited to inject and execute PHP code with the help of the 'systemdomain' parameter...

UCMS Cross-Site Scripting Vulnerability (CNVD-2018-19624)

UCMS is a content management system written in PHP. A cross-site scripting vulnerability exists in the install/index.php page in UCMS version 1.4.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'mysqldbname' parameter...

CVE-2018-17034: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...

CVE-2018-17036: Improper Control of Generation of Code

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-17035: Improper Neutralization of Special Elements used in an SQL Command

UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...

PT-2018-13851

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to SQL injection that occurs during the installation process. Specifically, the mysql dbname parameter in the install/index.php endpoint is vulnerable. Recommendations For version 1.4.6, avoi...

PT-2018-13852

Name of the Vulnerable Software and Affected Versions UCMS versions 1.4.6 through 1.6 Description An issue allows PHP code injection during installation via the systemdomain parameter to "install/index.php", as demonstrated by injecting a phpinfo call into /inc/config.php. Recommendations For UCM...

PT-2018-13850

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the mysql dbname parameter of the install/index.php file...

CVE-2018-12175

Default install directory permissions in Intel Distribution for Python IDP version 2018 may allow an unprivileged user to escalate privileges via local access...

CVE-2018-12175

Default install directory permissions in Intel Distribution for Python IDP version 2018 may allow an unprivileged user to escalate privileges via local access...

Ettercap - A Comprehensive Suite For Man In The Middle Attacks

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis. ETTERCAP...

PT-2018-11049

Name of the Vulnerable Software and Affected Versions Intel Distribution for Python IDP version 2018 Description The issue concerns default install directory permissions in Intel Distribution for Python, which may allow an unprivileged user to escalate privileges via local access. Recommendations...

CScms Cross-Site Scripting Vulnerability

CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the \upload\plugins\sys\Install.php file in CScms version 4.1. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML by using the site name...

Security Bulletin: IBM OpenPages GRC Platform is affected by an Information disclosure vulnerability (CVE-2017-1679)

Summary IBM OpenPages GRC Platform has addressed information disclosure vulnerability CVE-2017-1679 Vulnerability Details CVEID: CVE-2017-1679 DESCRIPTION: IBM OpenPages GRC Platform could allow an attacker to obtain sensitive information from error log files. CVSS Base Score: 6.2 CVSS Temporal...

CVE-2018-16344

An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock...

Fedora Update for libzypp FEDORA-2018-13f9b69e5c

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-7685 libzypp does not reevaluate malicious rpms once downloaded

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download...