3589 matches found
RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...
RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData...
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language EL injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData. Recen...
SQL Injection Vulnerability in ZZCMS fu***.php Page
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the ZZCMS fu.php page. An attacker can exploit the vulnerability to obtain sensitive information from the database...
SQL Injection Vulnerability in the Frontend of Online Learning System of Beijing Xinqi Technology Co.
Beijing Xinqi Technology Co., Ltd. is a technical service enterprise specializing in the research and development of training management software. A SQL injection vulnerability exists in the frontend of the online learning system of Beijing Xinqi Technology Co. An attacker can exploit the...
S-CMS News Portal System me***.php page suffers from SQL injection vulnerability
S-CMS news portal system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise to provide solutions to build a station. A SQL injection vulnerability exists in the me.php page of the S-CMS news portal system. An attacker can exploit the vulnerability to obtain sensitive...
SQL Injection Vulnerability in Frontend me***.Asp Page of Rongguang Information Ordering and Consumption System
Rongguang Information Ordering and Picking Up Food Consumption System is a multi-functional ordering system developed by Shenzhen Rongguang Information Co. SQL injection vulnerability exists in the front-end me.Asp page of Rongguang Information Ordering and Consumption System, which can be...
RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...
SQL injection vulnerability in ShopsN open source online store full web system (CNVD-2018-22114)
ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co., Ltd. a full-featured enterprise-class commercial standards in line with the real allow free commercial use of open source online store full network system. ShopsN open source online store system has a...
SQL Injection Vulnerability in PHPMyWind Backend
PHPMyWind is a PHP+MySQL based, W3C compliant website building engine for enterprise level website building. A SQL injection vulnerability exists in the backend of PHPMyWind. An attacker can exploit the vulnerability to obtain sensitive database information...
Component AlphaIndex Dictionaries SQL Injection Vulnerability in Joomla!
Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Joomla! component AlphaIndex Dictionaries. The vulnerability is caused by an attacker inserting SQL commands into the query string of a w...
SQL injection vulnerability in ShopsN open source online store full web system (CNVD-2018-21970)
ShopsN free version of the B2C e-commerce is a Shanghai Yisu Network Technology Co., Ltd. in line with the enterprise-level commercial standards full-featured really allow free commercial use of open source online store full network system. ShopsN v2.3.5 official version of the existence of SQL...
CVE-2018-17283
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
UCMS SQL Injection Vulnerability
UCMS is a content management system written in PHP. A SQL injection vulnerability exists in the install/index.php file in UCMS version 1.4.6. A remote attacker can exploit this vulnerability to execute SQL commands with the help of the 'mysqldbname' parameter...
RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...
IBM Maximo Asset Management SQL Injection Vulnerability (CNVD-2018-17089)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. An SQL injectio...
CVE-2018-15904
A10 ACOS Web Application Firewall WAF 2.7.1 and 2.7.2 before 2.7.2-P12, 4.1.0 before 4.1.0-P11, 4.1.1 before 4.1.1-P8, and 4.1.2 before 4.1.2-P4 mishandles the configured rules for blocking SQL injection attacks, aka A10-2017-0008...
WordPress Plugin Chained Quiz SQL Injection Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Chained Quiz, which can be exploited by attackers to execute...
SQL Injection Vulnerability in Website Building System of Shanghai Bonning Network Technology Co.
Shanghai Bonning Network Technology Co., Ltd. is a company dedicated to the application and promotion of website building and e-commerce for enterprises and institutions. Shanghai Bonning Network Technology Co., Ltd. website building system has SQL injection vulnerability, attackers can use the...