Command Execution Vulnerability in Five Fingers CMS Backend

Five Fingers CMS is an open source content management system that supports LNAMP architecture. Five Fingers CMS backend has a command execution vulnerability that can be exploited by attackers to gain control of the web server...

Arbitrary File Deletion Vulnerability in WMCMS (CNVD-2021-13595)

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS arbitrary file deletion vulnerability , an attacker can exploit the vulnerability to delete any file under the server...

Arbitrary File Deletion Vulnerability in Bacardi CMS Microstore (CNVD-2021-12795)

Bacardi CMS MicroMall is a free and open source object-oriented multi-store multi-user micro-mall PHP development framework. Hundred CMS Micro Mall arbitrary file deletion vulnerability exists. Attackers can use this vulnerability in the case of login to delete arbitrary files on the server...

CVE-2020-26285

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...

Remote code execution

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...

CVE-2020-26252

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server...

Design/Logic Flaw

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data request.getInputStream to a user specified location request.getHeader"File-Name". This issue may lead to arbitrary file upload which can be used to upload a WebShell to...

Microsoft Windows/Windows Server Remote Code Execution Vulnerability (CNVD-2021-87314)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A remote code execution vulnerability exists in Microsoft Windows/Windows Server "Remote...

CVE-2021-23241

The CVE-2021-23241 entry affects MERCUSYS Mercury X18G 1.0.5 routers. The connected Nuclei template confirms a Local File Inclusion/Directory Traversal vulnerability via ../ in conjunction with a loginLess or login.htm URI, enabling an authentication bypass and access to sensitive web-server file...

Webswing Remote Code Execution Vulnerability

Webswing is a web server that lets you run any swing application in a web browser using only pure HTML5. A remote code execution vulnerability exists in JsLink in Webswing that can be exploited by an attacker to execute code in the server...

Design/Logic Flaw

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image...

CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

CVE-2020-35370

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

Serious vulnerabilities fixed in Dell Wyse ThinOS

Vulnerabilities have been fixed in Dell Wyse ThinOS. A malicious person with access to a local FTP server could exploit the vulnerabilities to obtain sensitive information. The malicious party, by accessing this information and the ability to modify configuration files, the entire system. Dell ha...

OPENSUSE-SU-2020:2186-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2020-25712: Fixed a heap-based buffer overflow which could have led to privilege escalation bsc1177596. - CVE-2020-14360: Fixed an out of bounds memory accesses on too short request which could lead to denial of service bsc1174908...

OPENSUSE-SU-2020:1993-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 2.6.5: - Solved potential bug of SCC repository URLs changing over time. RMT now self heals by removing the previous invalid repository and creating the correct one. - Add web server settings to /etc/rmt.conf: Now it's...

SUSE-SU-2020:3466-1 Security update for SUSE Manager Server 4.0

This update fixes the following issues: bind-formula: - Temporarily disable dnssec-validation as hotfix for bsc1177790 - Update to version 0.1.1603299886.60e4bcf grafana-formula: - Use variable for product name - Add support for system groups in Client Systems dashboard postgresql-jdbc: - Address...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: =8.8.9, =13.4, =13.5, 13.5.2...

Design/Logic Flaw

The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component e.g., a button when events such as click, hover, etc. occur...

CVE-2020-7207

CVE-2020-7207 affects HPE ProLiant Gen10 servers with Intel Innovation Engine. The vulnerability enables local privilege escalation via physical access to the server motherboard. Root cause: compromised access to hardware/platform state enables elevation of privileges; impact includes high confid...