CVE-2021-25780

An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell...

Privilege escalation

An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell...

QIWI: Remote Code Execution on contactws.contact-sys.com via SQL injection in TAktifBankObject.GetOrder in parameter DOC_ID

Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the DOCID parameter on the TAktifBankObject operation GetOrder to inject arbitrary SQL statements into...

Pelco Digital Sentry Server Code Issue Vulnerability

A code issue vulnerability exists in Pelco Digital Sentry Server that arises from improper design or implementation during code development for a network system or product...

com.sap.scimono.examples:simple-server (>=0.0.2 <=0.0.18), com.sap.scimono:scimono-client (>=0.0.1 <=0.0.18) +1 more potentially affected by CVE-2021-21479 via com.sap.scimono:scimono-server (>=0.0.1 <=0.0.18)

com.sap.scimono:scimono-server MAVEN version =0.0.1, =0.0.2, =0.0.1, =0.0.11, =0.0.18 Source cves: CVE-2021-21479 Source advisory: OSV:GHSA-29Q4-GXJQ-RX5C...

ArcGIS Server has an Arbitrary File Read Vulnerability

ArcGIS Server is ESRI released to provide Web-oriented spatial data services for an enterprise-class GIS software platform. ArcGIS Server has an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

Command Execution Vulnerability in HulaCWMS

HulaCWMS Hula enterprise website management system is based on ThinkPHP5 framework for the development of enterprise website management system. HulaCWMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

Command execution vulnerability in Five Fingers CMS backend (CNVD-2021-16338)

Five Fingers CMS is an open source content management system that supports LNAMP architecture. Five Fingers CMS backend has a command execution vulnerability that can be exploited by attackers to gain control of the web server...

SolarWinds Serv-U FTP Server Authorization Issues Vulnerability

SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the US-based SolarWinds Corporation. A security vulnerability exists in SolarWinds Serv-U before 15.2.2 Hotfix 1, which stems from a directory containing a user configuration file which includes a user's password...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the MySQL Server component of the database management system involves deficiencies in access control. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL network protocol...

Vulnerability of the Server component: The Optimizer component of the MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the MySQL Server component of the database management system involves deficiencies in access control. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL network protocol...

Cccel-ppp Number Error Vulnerability

Cccel-ppp is a C-based server-side application for providing PPTP/L2TP/SSTP/PPPoE/IPoE support by the individual developer of Cccel-ppp. A security vulnerability exists in accel-ppp, which can be exploited by attackers to cause arbitrary code execution...

CVE-2021-2001

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 5.6.50 and prior, 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to...

Security Bulletin: It is possible to download arbitrary server files via ViewONE server (CVE-2019-4260)

Summary A logged in user may be able to download arbitrary files from the server using the ViewONE Virtual platform. Vulnerability Details CVEID: CVE-2019-4260 DESCRIPTION: IBM Daeja ViewONE Professional, Standard & Virtual could allow an unauthorized user to download server files resulting in...

Server side request forgery (ssrf)

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request...

Code injection

openMAINT before 1.1-2.4.2 allows remote authenticated users to run arbitrary JSP code on the underlying web server...

VulnCheck KEV: CVE-2020-8283

An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9...

Nextcloud 资源管理错误漏洞

Nextcloud is a set of client-server software for creating file hosting services and using them.Nextcloud Server is the server software. A denial of service vulnerability exists in Nextcloud Server 19 and earlier versions. The vulnerability stems from a checking error. An attacker could exploit th...

CVE-2021-2038

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2021-1998

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...