CVE-2022-43030

Siyucms v6.1.7 was discovered to contain a remote code execution RCE vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges...

Multiple Vulnerabilities in Isthmus Electronic Document Security Management System

Yisetong electronic document security management system is an electronic document security protection software, the system utilizes the driver layer transparent encryption technology, through the encryption protection of electronic documents, to prevent internal employees from leaking and externa...

Microsoft Exchange Server Elevation of Privilege Vulnerability

...

CVE-2018-25041 uTorrent JSON RPC Server privileges management

A vulnerability was found in uTorrent. It has been rated as critical. Affected by this issue is some unknown functionality of the component JSON RPC Server. The manipulation leads to privilege escalation. The attack may be launched remotely. The exploit has been disclosed to the public and may be...

Command injection

The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command...

CVE-2022-24780 Code Injection in Combodo iTop

Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in version...

CVE-2022-0551

Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian...

Microsoft Exchange Server Elevation of Privilege Vulnerability

...

File Upload Vulnerability in PHPOK of Shenzhen Kunshuo Technology Co., Ltd (CNVD-2021-51870)

PHPOK is a website building content management system to achieve customized open source free website building cms system. Ltd. PHPOK file upload vulnerability, attackers can use the vulnerability to upload webshell, to obtain server privileges...

File upload vulnerability in disk enterprise LCMS (CNVD-2021-43592)

Pan Enterprise LCMS is a lightweight PHP development framework . A file upload vulnerability exists in PanEnterprise LCMS. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Command Execution Vulnerability in Amami Digital Hotel's Broadband Operations System

Ammed Century Beijing Technology Co., Ltd. is a digital service solution provider and digital content operation service provider for star-rated hotels. A command execution vulnerability exists in Ammed's digital hotel broadband operation system. An attacker can exploit this vulnerability to gain...

Command Execution Vulnerability in XMDNS-6800 Dynamic System from Siemer Technologies

Simmer Technology is a high-tech enterprise integrating R&D, production and sales. It is a device manufacturer focusing on Internet management and optimization, and a production provider of smart home products and solutions, smart locks, smart DNS, and other products. A command execution...

Command Execution Vulnerability in DiYunCMS (CNVD-2021-35560)

DiYunCMS is based on PHP7 language using the latest CodeIgniter4 as the development framework for the production of web content management framework, to provide "computer Web site, cell phone Web site, APP interface" integrated Web site technology solutions. DiYunCMS has a command execution...

Apache Druid 0.20.0 Remote Command Execution

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests; however, that feature is disabled by default. In Druid versions prior to 0.20.1, an authenticated user can send a specially-crafted request that both enables the JavaScript...

File Upload Vulnerability in Website Building System of Guangdong Southern Digital Technology Co.

Founded in 2003 and headquartered in Guangzhou, Guangdong Southern Digital Technology Co., Ltd Southern Digital is a leading geographic information developer and service provider integrating data, software and services, and one of the "Top 100 Enterprises" in China's geographic information...

File Upload Vulnerability in Fusion Command and Dispatch System of Fujian Clarisonic Communication Co.

Founded in 2001, Fujian Qualicom Communication Co., Ltd. is a solution provider and operation service provider focusing on professional communication. A file upload vulnerability exists in the Converged Command and Dispatch System of Fujian Qualicom Communication Co. An attacker can exploit the...

Command Execution Vulnerability in PHPYUN Talent Acquisition System beta (CNVD-2021-26194)

PHPYUN Talent Recruitment System is a PHP and MySQL database to build an efficient and open source talent and enterprise job search recruitment, hiring solutions. A command execution vulnerability exists in the beta version of PHPYUN Recruitment System. An attacker can exploit this vulnerability ...

Command Execution Vulnerability in SDCMS-B2C Mall Website Management System (CNVD-2021-25006)

SDCMS-B2C mall website management system integrates city substation, cloud storage, three-level distribution, WeChat public number, combination package, multi-people group and many other functions in one marketing mall management system. SDCMS-B2C Mall Website Management System has a command...

CVE-2021-0370

In Write of NxpMfcReader.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Andro...

Command Execution Vulnerability in Tongda OA (CNVD-2021-23368)

Tongda OA Office Anywhere Network Intelligent Office System is a collaborative office automation software independently developed by Beijing Tongda Science and Technology Co., Ltd. and China's enterprise management practices combined with the formation of a comprehensive management office platfor...