Vulnerabilities fixed in Red Hat JBoss Enterprise Application Platform

Vulnerabilities have been fixed in Red Hat JBoss Enterprise Application Platform. The vulnerabilities allow a malicious person to able to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Bypassing authenticatio...

Vulnerabilities fixed in Apache HTTP server

Vulnerabilities have been fixed in Apache. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Access to sensitive data -= Ubuntu =- Canonical has...

CVE-2020-10779

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

CVE-2020-10779: Authorization Bypass Through User-Controlled Key

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references IDOR and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms...

SQL Injection Vulnerability in Beijing Zhongcheng Kexin Integrated Management Platform

Beijing Zhongcheng Kexin Technology Development Co., Ltd. is a service provider of the whole tourism industry chain with a high market share in China. A SQL injection vulnerability exists in the integrated management platform of Beijing Zhongcheng Kexin, which can be exploited by attackers to...

SQL Injection Vulnerability in Website Building System of Shenzhen Shenzhou Tongda Network Technology Co.

Shenzhen Shenzhou Tongda Network Technology Co., Ltd, provides Tencent enterprise mailbox, high-end website construction PC website, cell phone website, WeChat public account, SEO optimization and promotion, enterprise WeChat and other network infrastructure services and network marketing and...

Qualcomm Bugs Open 40 Percent of Android Handsets to Attack

Six serious bugs in Qualcomm’s Snapdragon mobile chipset impact up to 40 percent of Android phones in use, according research released at the DEF CON Safe Mode security conference Friday. The flaws open up handsets made by Google, Samsung, LG, Xiaomi and OnePlus to DoS and escalation-of-privilege...

SQL Injection Vulnerability in Go*** File of NiuShop Multi-Merchant Mall System of Shanghai Niuzhiyun Network Technology Co.

Niushop Multi-Merchant Mall System is a B2B2C mall system with Uniapp applet and Thinkphp6. Shanghai NiuZhiyun Network Technology Co., Ltd NiuShop Multi-commercial Mall System Go file there is a SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive information in...

SQL Injection Vulnerability in Anshan Guangwu Network Technology Co.

Anshan Guangwu Network Technology Co., Ltd. mainly provides website production and hosting maintenance, domain name registration services and network marketing and promotion programs. Anshan Guangwu Network Technology Co., Ltd. website building system SQL injection vulnerability, attackers can us...

SQL Injection Vulnerability in Hefei Blue Collar Business Co.

Hefei Blue Collar Business Information Co., Ltd. SEO team, founded in 2008, since its inception has been studying the combination of website Baidu optimization, Internet marketing, website construction. To provide enterprises with a full range of information technology application program. Hefei...

ZZCMS suffers from SQL injection vulnerability

ZZCMS is a content management system for Merchants Network. ZZCMS suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

SQL injection vulnerability in Ar***.asp page of website building system of Wuxi Yi Shang Technology Co.

Wuxi Yi Shang Technology Co., Ltd. is a network planning and marketing enterprise. Ltd. building system Ar.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...

SQL Injection Vulnerability in the Website Building System of Guangdong Kisite E-commerce Technology Co.

Ltd. is a B2B e-commerce website. There is a SQL injection vulnerability in the website system of Guangdong Kisitech E-commerce Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2020-2500: Improper Access Control

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...

CVE-2020-12041: Incorrect Permission Assignment for Critical Resource

The Baxter Spectrum WBM v17, v20D29, v20D30, v20D31, and v22D24 telnet Command-Line Interface, grants access to sensitive data stored on the WBM that permits temporary configuration changes to network settings of the WBM, and allows the WBM to be rebooted. Temporary configuration changes to netwo...

SQL Injection Vulnerability in Schoolfree Psychological Assessment System (CNVD-2020-41310)

The School Worry-Free Psychological Assessment System is a platform for online mental health testing and diagnosis via the Internet. A SQL injection vulnerability exists in the School Worry Free Psychological Assessment System. An attacker can exploit the vulnerability to obtain sensitive...

OMERO.web Information Disclosure Vulnerability

OMERO.web is a client program from the Open Microscopy Environment team for viewing images on the OMERO server from a web browser. A security vulnerability exists in OMERO.web versions prior to 5.6.3, which arises when the program passes sensitive data elements, such as a session key, as URL quer...

SQL Injection Vulnerability in Human Resource Management System of Dongguan Zhiyue Software Technology Co.

Dongguan Zhiyue Software Technology Co., Ltd. is an enterprise informatization platform focusing on EHR+ERP+OA three systems in one, and is a supplier integrating R&D, production, sales and service. There is a SQL injection vulnerability in the human resource management system of Dongguan Zhiyue...

SQL Injection Vulnerability in Website Building System of Chifeng E-top Network Limited (CNVD-2020-41757)

Ltd. is mainly engaged in website construction, website promotion, website planning, software development, network promotion, network integrated marketing and other businesses. There is a SQL injection vulnerability in the website building system of Chifeng E-top Network Co., Ltd, which can be...

SQL Injection Vulnerability in Website Building System of Chifeng E-top Network Limited (CNVD-2020-41335)

Chifeng ETO Network Co., Ltd. is a service company mainly engaged in website construction and website promotion. There is a SQL injection vulnerability in the website building system of Chifeng E-top Network Co., Ltd, which can be exploited by attackers to obtain sensitive information in the...