4160 matches found
Oracle VM VirtualBox Access Control Error Vulnerability (CNVD-2019-27297)
Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The solution is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...
CVE-2019-0024
A persistent cross-site scripting XSS vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...
CVE-2019-6296
Cleanto 5.0 has SQL Injection via the assets/lib/exportajax.php id parameter...
PT-2019-1322 · Oracle +6 · Mysql Server +5
Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.13 and prior Description: The issue is related to inadequate access control in the Server: Connection component of Oracle MySQL Server. This can be exploited by a remote attacker to cause a denial of service...
CVE-2018-15007
The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069trxl601sky/x6069trxl601sky:6.0/MRA58K/1482897127:user/release-keys contains a pre-installed platform app with a package name of com.fw.upgrade.sysoper versionCode=238, versionName=2.3.8 that contains an exported broadcast...
S-CMS SQL Injection Vulnerability (CNVD-2018-26676)
S-CMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in the bank/callback1.php file in S-CMS version 3.0, which stems from the program's failure to filter the 'Pno' field, and can be exploited by remote attackers to execute SQL statements with the...
CVE-2018-2492
SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50...
Google Android elevation of privilege vulnerability (CNVD-2019-01567)
Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An arbitrary memory release vulnerability exists in the reallyinstallpackage of install.cpp in Google Android 7.0, 7.1.1, and 7.1.2. A local attacker can exploit this...
IBM Connections Information Disclosure Vulnerability (CNVD-2018-26361)
IBM Connections is a suite of social software platforms from IBM in the United States. The platform provides advanced analytics and real-time data monitoring capabilities, and accelerates web collaboration within and outside the organization through IBM SmartCloud services. An information...
SQL Injection Vulnerability in emlog v6.0.0 Backend wi***.php Page
Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. A SQL injection vulnerability exists in the emlog v6.0.0 backend wi.php page. An attacker can exploit the vulnerability to obtain sensitive database information...
TOTOLINK A3002RU Cross-Site Scripting Vulnerability (CNVD-2018-24107)
TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the noticegen.htm page of the TOTOLINK A3002RU version 1.0.8. A remote attacker can exploit this vulnerability by modifying the "User phrases button" field to execute...
CVE-2018-19543
An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2decode in libjasper/jp2/jp2dec.c...
CVE-2018-19539
An issue was discovered in JasPer 2.0.14. There is an access violation in the function jasimagereadcmpt in libjasper/base/jasimage.c, leading to a denial of service...
UBUNTU-CVE-2018-4386
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...
CVE-2018-18861
Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command...
School Equipment Monitoring System SQL Injection Vulnerability
School Equipment Monitoring System is a school equipment management system. A SQL injection vulnerability exists in School Equipment Monitoring System version 1.0. A remote attacker can use the login page to view, add, modify, or delete information in the back-end database...
CVE-2018-18759
Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow...
CVE-2018-1639
The Report Builder of Jazz Reporting Service 5.0 through 5.0.2 and 6.0 through 6.0.6 could allow an authenticated user to obtain sensitive information beyond its assigned privileges. IBM X-Force ID: 144579...