Oracle MySQL Server Access Control Error Vulnerability (CNVD-2019-16278)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the MySQL Server component of Oracle MySQL, version 5.7.25 and earlier, and the Server: Audit Plug-in subcomponent...

Apache HTTP Server Authentication Bypass Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation of an open source web server . An authentication bypass vulnerability exists in Apache HTTP Server. An attacker can exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations...

PhreeBooks ERP 5.2.3 - Remote Command Execution (1)

Exploit Title: PhreeBooks ERP 5.2.3 - Remote Command Execution Date: 2010-04-03 Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://www.phreesoft.com/ Software Link: https://sourceforge.net/projects/phreebooks/ Version: v5.2.3 Category: Webapps Tested on: XAMPP for Linux 5.6.38...

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations require...

openSUSE Security Update : mariadb (openSUSE-2019-427)

This update for mariadb to version 10.2.15 fixes the following issues : These security issues were fixed : - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library Return of BACKRONYM bsc1088681. - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent:...

CVE-2018-13798

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V14, SICAM A8000 CP-802X All versions V14, SICAM A8000 CP-8050 All versions V2.00. Specially crafted network packets sent to port 80/TCP or 443/TCP could allow an unauthenticated remote attacker to cause a Denial-of-Service...

Intel Server Platform Services Input Validation Error Vulnerability

Intel Server Platform Services SPS is a server platform services program from Intel Corporation in the U.S. The HECI subsystem is one of the host embedded controller interface subsystems. An input validation error vulnerability exists in Intel Server Platform Services that stems from the program...

CVE-2018-17944

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are...

The vulnerability of the web server for the software development tools, Intel Data Center Manager SDK, allows a perpetrator to increase their privileges.

The vulnerability of the Intel Data Center Manager SDK, a tool for developing software, is related to improper session management. Exploiting this vulnerability can allow attackers to enhance their privileges...

UltraVNC Code Execution Vulnerability

UltraVNC is an open source remote terminal control software for the Windows platform. A security vulnerability exists in the VNC server code in UltraVNC version 1211. An attacker could exploit the vulnerability to execute code...

Starbucks: Webshell via File Upload on ecjobs.starbucks.com.cn

Summary: OS Command Injection which can let the attacker who get more important information of the server,such as disclosures internal source code of the webapp,database data and invade the internal network. Description: I found that users can upload asp/aspx and other dynamic files via the avata...

Code injection

On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle MITM attack, despite the...

Vulnerability of the Server component: Security: Privileges of the MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server component: Security: Privileges of the Oracle MySQL database management system is related to insufficient access control. Exploiting this vulnerability may allow a malicious actor to cause service interruptions...

Vulnerability of the Server component: The DDL system for database management in MySQL, which allows a hacker to cause a service failure.

The vulnerability of the Server component: The DDL system for database management in Oracle MySQL is related to insufficient access control. Exploiting this vulnerability may allow a malicious actor to cause service interruptions...

Vulnerability of the Server component: Security: Privileges of the MySQL database management system, which allows a hacker to cause a service failure

The vulnerability of the Server component: Security: Privileges of the Oracle MySQL database management system is related to insufficient access control. Exploiting this vulnerability may allow a malicious actor to cause service interruptions...

Vulnerability of the Server component: Connection Handling in the MySQL database management system, which allows attackers to cause service interruptions.

The vulnerability of the Server: Connection Handling component of the Oracle MySQL database management system is related to insufficient access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

[ASA-201902-10] libcurl-gnutls: arbitrary code execution

Arch Linux Security Advisory ASA-201902-10 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-877 Summary...

POWER EGG vulnerability where EL expression may be executed

Overview POWER EGG provided by D-CIRCLE inc. is an integrated collaboration tool. POWER EGG contains a vulnerability where an arbitray EL expression may be executed CWE-20. Touma Hatano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

Directory Traversal

static-resource-server is vulnerable to directory traversal. A remote attacker is able to access arbitrary files on the server by appending ../ characters within the URI...

CVE-2018-16482

A server directory traversal vulnerability was found on node module mcstatic =0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path...