PT-2018-7142 · Openstack · Openstack Orchestration (Heat) Service

Name of the Vulnerable Software and Affected Versions: OpenStack Orchestration heat service versions prior to 8.0.0 OpenStack Orchestration heat service version 6.1.0 OpenStack Orchestration heat service version 7.0.2 Description: An access-control flaw was found in the OpenStack Orchestration he...

SQL Injection Vulnerability in V1.7 Backend of School Worry-free Enterprise Building System

School carefree enterprise website system Xiao5uCompany is a set of company and enterprise-oriented website building system. SQL injection vulnerability exists in the background of XiaowuCompany V1.7. An attacker can exploit the vulnerability to obtain sensitive information from the database...

Zenphoto local file inclusion vulnerability (CNVD-2018-16271)

Zenphoto is a free photo gallery content management system developed by the Zenphoto team. The system manages images and supports multimedia such as audio and video. A local file inclusion vulnerability exists in Zenphoto 1.4.14 and earlier versions. A remote attacker with administrative privileg...

CVE-2018-0610

Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information...

NodAPS 'search' SQL Injection Vulnerability

NodAPS is an online appointment management system available in multiple languages and is used to help users schedule appointments more efficiently. A SQL injection vulnerability exists in NodAPS 'search'. An attacker can exploit the vulnerability to gain access to sensitive database information...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by exposure of sensitive information to be cached by browser (CVE-2016-6097)

Summary IBM Security Key Lifecycle Manager allows web pages containing sensitive information to be cached by a browser. As a result this information will be stored unsafely for an indefinite amount of time on the user's hard drive. Attackers with local access or malware installed on the user's...

Monitoring Data & Data Access to Support Ongoing GDPR Compliance – Part III: Tools

The new European Union EU-wide General Data Protection Regulation GDPR was signed into law in late April 2016, and the compliance deadline came into effect on May 25, 2018. The Regulation is expansive and covers a variety of subject areas, provisions, and actions in the form of documented Article...

CVE-2018-4226

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. watchOS before 4.3.1 is affected. The issue involves the "Security" component. It allows local...

SQL Injection Vulnerability in PHP Multilingual Version V2.7 of SEMCMS Foreign Trade Web Site

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SEMCMS foreign trade website PHP...

SQL Injection Vulnerability in ASRock's Website CMS

TechSpring Technology Limited is a one-stop IT solution provider. A SQL injection vulnerability exists in ASRock's website builder CMS. Attackers can exploit the vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in Hainan Creative Media pc Website Building System

Hainan Creative Future Culture Media Co., Ltd. is engaged in brand one-stop service e-commerce advertising consulting services media enterprises. We design complete solutions for users and provide the best advertising support services. A SQL injection vulnerability exists in the pc website builde...

D-Link DIR-620 Router Information Disclosure Vulnerability

D-link DIR-620 is a wireless router product of AUO D-Link. web server is one of the web servers. A security vulnerability exists in the web server of the D-Link DIR-620, which originates from the use of a hard-coded password for the admin account. An attacker can exploit this vulnerability to...

CVE-2018-8714

Honeywell MatrikonOPC OPC Controller before 5.1.0.0 allows local users to transfer arbitrary files from a host computer and consequently obtain sensitive information via vectors related to MSXML libraries...

CVE-2018-0323

A vulnerability in the web management interface of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to conduct a path traversal attack on a targeted system. The vulnerability is due to insufficient validation of web request parameters. An attacker w...

SQL Injection Vulnerability in SMiCMS School Station Group System v20180314 Version

State Micro CMS formerly PHP168 S series is a leading manufacturer of domestic government, school and group platforms, and is also the largest open source system provider in the field of PHP in southern China. State Micro CMS school station group system v20180314 version of the existence of SQL...

Amazon Linux 2 : libvncserver (ALAS-2018-1012)

Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly...

Medium: libvncserver

Issue Overview: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or...

Google Android Framework (aosp email application) Information Disclosure Vulnerability

Android on Google Pixel and Nexus is a Linux-based open source operating system for the Google Pixel and Nexus smartphones developed by Google and the Open Handset Alliance OHA.Framework aosp email application is a framework for email applications. Framework aosp email application is one of the...

SQL Injection Vulnerability at CMS destination

Situ CMS is a self-developed website management system suitable for tourism website construction. A SQL injection vulnerability exists in CMS destination. The vulnerability is caused due to the system failing to strictly filter user input data. An attacker can exploit this vulnerability to obtain...

Multiple SQL Injection Vulnerabilities in GxlcmsQY System

GxlcmsQY system is a simple program tailored for business users. GxlcmsQY System has multiple SQL injection vulnerabilities. An attacker can exploit the vulnerabilities to obtain sensitive database information...