Command Injection

Overview All versions of cocos-utils are vulnerable to Remote Code Execution. The unzip function concatenates user input to exec which may allow attackers to execute arbitrary commands on the server. Recommendation No fix is currently available. Consider using an alternative module until a fix is...

Vulnerability of the Server component: Security: Roles of the Oracle MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server: Security component involves deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using the MySQL protocol...

Vulnerability of the Server component: The Oracle MySQL database management system’s options, which allow a hacker to cause a service failure.

The vulnerability of the Server component involves deficiencies in access control of the Oracle MySQL database management system. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...

UBUNTU-CVE-2019-2592

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: PS. Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...

CVE-2019-11446

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase a...

Design/Logic Flaw

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase a...

CVE-2019-3398

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2019-10376)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: DDL subcomponent of the MySQL Server component in Oracle MySQL, version 8.0.15 and earlier. An attacke...

CVE-2019-6570

A vulnerability has been identified in SINEMA Remote Connect Server All versions V2.0. Due to insufficient checking of user permissions, an attacker may access URLs that require special authorization. An attacker must have access to a low privileged account in order to exploit the vulnerability...

Oracle MySQL Server Access Control Error Vulnerability (CNVD-2019-16278)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the MySQL Server component of Oracle MySQL, version 5.7.25 and earlier, and the Server: Audit Plug-in subcomponent...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2019-14567)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Partition subcomponent of the MySQL Server component in Oracle MySQL, version 8.0.15 and earlier. An...

Apache HTTP Server Authentication Bypass Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation of an open source web server . An authentication bypass vulnerability exists in Apache HTTP Server. An attacker can exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations...

PhreeBooks ERP 5.2.3 - Remote Command Execution (1)

Exploit Title: PhreeBooks ERP 5.2.3 - Remote Command Execution Date: 2010-04-03 Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://www.phreesoft.com/ Software Link: https://sourceforge.net/projects/phreebooks/ Version: v5.2.3 Category: Webapps Tested on: XAMPP for Linux 5.6.38...

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations require...

openSUSE Security Update : mariadb (openSUSE-2019-427)

This update for mariadb to version 10.2.15 fixes the following issues : These security issues were fixed : - CVE-2018-2767: Enforse use of SSL/TLS in embedded server library Return of BACKRONYM bsc1088681. - CVE-2018-2786: Vulnerability in the MySQL Server component of Oracle MySQL subcomponent:...

CVE-2018-13798

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V14, SICAM A8000 CP-802X All versions V14, SICAM A8000 CP-8050 All versions V2.00. Specially crafted network packets sent to port 80/TCP or 443/TCP could allow an unauthenticated remote attacker to cause a Denial-of-Service...

Intel Server Platform Services Input Validation Error Vulnerability

Intel Server Platform Services SPS is a server platform services program from Intel Corporation in the U.S. The HECI subsystem is one of the host embedded controller interface subsystems. An input validation error vulnerability exists in Intel Server Platform Services that stems from the program...

CVE-2018-17944

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are...

The vulnerability of the web server for the software development tools, Intel Data Center Manager SDK, allows a perpetrator to increase their privileges.

The vulnerability of the Intel Data Center Manager SDK, a tool for developing software, is related to improper session management. Exploiting this vulnerability can allow attackers to enhance their privileges...

UltraVNC Code Execution Vulnerability

UltraVNC is an open source remote terminal control software for the Windows platform. A security vulnerability exists in the VNC server code in UltraVNC version 1211. An attacker could exploit the vulnerability to execute code...