Authentication Bypass in console-io

Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows terminal access on the server via a web page, an authentication bypass is essentially remote code...

Command Execution Vulnerability in HDCMS v2.0

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. A command execution vulnerability exists in HDCMS v2.0, which can be exploited by an attacker to gain control of a...

Oracle MySQL Server Access Control Error Vulnerability (CNVD-2019-26711)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. An access control error vulnerability exists in the MySQL Server component of Oracle MySQL, version 5.7.24 and earlier, and the Server: Optimizer...

CVE-2019-0029

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3...

PT-2019-1324 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.13 and prior Description: The issue is related to insufficient access control in the Server: DDL component of Oracle MySQL Server, allowing a remote attacker to cause a denial of service. Successful exploitati...

WordPress Plugin Monsters-Editor-10-For-WP-Super-Edit Remote Upload Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A remote upload vulnerability exists in the WordPress plugin Monsters-Editor-10-For-WP-Super-Edit. Allows an attacker to uplo...

WordPress Plugin Sem-Wysiwyg Remote Upload Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A remote upload vulnerability exists in the WordPress plugin Sem-Wysiwyg. Allows an attacker to upload a webshell and gain...

The vulnerability of the Mercuria version control software, related to access control errors, allows a violator to compromise data confidentiality and integrity.

The vulnerability of the Mercuria version control software is related to errors in access control on the server. Exploiting this vulnerability can allow a malicious actor to compromise data confidentiality and integrity...

RATELIMITED: HTTP PUT method enabled

Hi security team, Summary: It is possible to upload files to the server using the PUT method Steps To Reproduce: I used the following request: PUT /emitrani.txt HTTP/1.1 Host: ratelimited.me Content-Length: 10 Connection: close Now a file exists at https://ratelimited.me/emitrani.txt with content...

DOUPHP has a file upload vulnerability

DouPHP is a lightweight enterprise website management system based on PHP+Mysql architecture, running on various platforms such as Linux, Windows, MacOSX, Solaris and so on. DOUPHP suffers from a file upload vulnerability. The vulnerability is caused by the website upload function failing to...

CVE-2018-15537

Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...

Unrestricted file upload

Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...

CVE-2018-15537

Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...

CVE-2018-15537

Unrestricted file upload with remote code execution in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests...

Baidu WebUploader component suffers from file upload vulnerability

WebUploader is a simple HTML5-based, FLASH-supported modern file upload component developed by the Baidu WebFE FEX team. A file upload vulnerability exists in the Baidu WebUploader component. The vulnerability is due to the WebUploader component upload page to the file type or file extension...

Cybozu Dezie Directory Traversal Vulnerability

Cybozu Dezie is a Web-based database system from Cybozu. A directory traversal vulnerability exists in Cybozu Dezie, which can be exploited by a remote attacker to delete arbitrary files on the server...

DocCms 2016 version has a file upload vulnerability at the backend templates

DocCMS rice husk enterprise building system, also known as rice husk cms, doccms, formerly known as deep throat enterprise building system ShlCms, is the industry's leading free open source enterprise website building system, enterprise website generation system. DocCms 2016 version of the file...

CVE-2018-10683

DISPUTED An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a...

File Upload Vulnerability in Chengdu Silo Technology Co.

Chengdu Silo Technology Co., Ltd. provides WEB-based system development, services covering web design, website program development, mainstream domain name registration, domestic and international space application, WEB system development, secondary development of WeChat, cell phone website...

Arbitrary File Deletion Vulnerability in Laoban CMS v2.0

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. Laoban CMS v2.0 has an arbitrary file deletion vulnerability. The vulnerability is due to the program in the deletion of pictures, di...