3136 matches found
PT-2018-15310
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8 Description The issue affects the gradebook dependencies tool in the main/template/default/admin/gradebook list.tpl file, allowing authenticated users to impact other users under specific permission conditions grante...
PT-2018-15311
Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8 Description The issue allows authenticated users to affect other users under specific conditions of permissions granted by administrators. It is considered low risk due to the nature of the feature it exploits. The...
DEBIAN-CVE-2018-20191
hw/rdma/vmw/pvrdmamain.c in QEMU does not implement a read operation such as uarread by analogy to uarwrite, which allows attackers to cause a denial of service NULL pointer dereference...
UBUNTU-CVE-2018-1000852
FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvcmain.c, drdynvcprocesscapabilityrequest that can result in The RDP server can read the client's memory.. This attack appear to...
DEBIAN-CVE-2018-20123
pvrdmarealize in hw/rdma/vmw/pvrdmamain.c in QEMU has a Memory leak after an initialisation error...
Design/Logic Flaw
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...
CVE-2018-20159
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...
CVE-2018-20017
SEMCMS 3.5 has XSS via the first text box to the SEMCMSMain.php URI...
NA300 PLC has an unauthorized operation vulnerability
The NA300 PLC is a mid-size programmable controller. An unauthorized operation vulnerability exists in the NA300 PLC. An attacker can exploit the vulnerability to remotely tamper with the MAIN program in the PLC...
Microstrategy Analytics Cross-Site Request Forgery Vulnerability
Microstrategy Analytics is a suite of enterprise data analytics platforms from Microstrategy, Inc. in the United States. The platform features data discovery, data visualization and report generation. A cross-site request forgery vulnerability exists in the main.aspx file in Microstrategy Analyti...
CVE-2018-19557
An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...
CVE-2018-19558
An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...
Sql injection
An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...
CVE-2018-19558: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...
PT-2018-15002
Name of the Vulnerable Software and Affected Versions arcms through 2018-03-19 Description An issue was discovered where no authentication is required for certain endpoints, including "index/main", "user/useradd", and "img/images". Recommendations For arcms through 2018-03-19, consider restrictin...
PT-2018-15003
Name of the Vulnerable Software and Affected Versions arcms through 2018-03-19 Description An issue exists in the software due to SQL injection via the limit parameter in the json/newslist endpoint. This is caused by files ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...
CVE-2018-19557: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...
Centreon Cross-Site Scripting Vulnerability (CNVD-2019-00828)
Centreon formerly known as Merethis Centreon is an open source IT monitoring software suite from Centreon France that needs to be paired with Nagios to manage Nagios via the web and third-party components to enable monitoring of networks, operating systems and applications. A cross-site scripting...
CVE-2018-19346
The u3d plugin 9.3.0.10809 aka plugins\U3DBrowser.fpi in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service out-of-bounds read or obtain sensitive information via a U3D sample because of a "Data from Faulting Address controls Branch Selection starting...