Oracle MySQL Server Access Control Error Vulnerability (CNVD-2019-26706)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the MySQL Server component of Oracle MySQL, version 5.7.24 and earlier, and the InnoDB subcomponent of Oracle MySQ...

PT-2019-1255 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 8.0.13 and prior Description: The issue is related to errors in access control within the Server component of Oracle MySQL. It allows a remote attacker to gain unauthorized access to protected data using network protocol...

Microsoft SharePoint Server Remote Elevation of Privilege Vulnerability (CNVD-2019-16195)

Microsoft Office is an office software suite developed by Microsoft Corporation.Microsoft SharePoint Enterprise Server is an enterprise business collaboration platform. A remote elevation of privilege vulnerability exists in Microsoft SharePoint Server, which can be exploited by an attacker to ga...

Command injection

The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service daemon crash via a crafted XRMD command...

Remote Code Execution (RCE)

esigate-core is vulnerable to remote code execution RCE. The ESIGate supports esi:include tag along with stylesheet attribute which would allow a remote attacker to execute code on the server with a user specified XSLT...

CVE-2018-20303

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925...

LibVNC Memory Misreference Vulnerability (CNVD-2019-05100)

LibVNC is a cross-platform C library for implementing VNC server and client functionality. A memory misreference vulnerability exists in the server code of the File Transfer extension in previous versions of LibVNC commit ca2a5ac02fbbadd0a21fabba779c1ea69173d10b. A remote attacker could exploit...

The vulnerability of the web server used by the Cisco Prime Service Catalog management tool allows a hacker to inject arbitrary code into the web page that is uploaded.

The vulnerability of the Cisco Prime Service Catalog management server relates to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the web page via a specially crafted link...

CVE-2018-19792

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service buffer overflow or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name involving ../ characters, which is...

CVE-2018-19791

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substri...

mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Security : Privileges. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via...

mysql: Client programs unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocol...

Microsoft SharePoint Server Remote Elevation of Privilege Vulnerability (CNVD-2019-14442)

Microsoft Office is an office software suite developed by Microsoft Corporation.Microsoft SharePoint Enterprise Server is an enterprise business collaboration platform. A remote elevation of privilege vulnerability exists in Microsoft SharePoint Server due to the program failing to properly filte...

SAP BusinessObjects Business Intelligence Platform Server Denial of Service Vulnerability

SAP BusinessObjects Business Intelligence Platform Servers is a suite of business intelligence software and enterprise performance solutions. The product features report generation, analytics, data visualization, and more. A denial of service vulnerability exists in SAP BusinessObjects Business...

CVE-2018-8581

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server...

JVN#15232217: Multiple directory traversal vulnerabilities in Cybozu Office

Cybozu Office provided by Cybozu, Inc. contains multiple directory traversal vulnerabilities below. Directory traversal vulnerability due to a flaw in processing parameter of the HTTP request CWE-22 - CVE-2018-0703 Version| Vector| Score ---|---|--- CVSS v3|...

httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS

By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 Affected 2.4.18-2.4.30,2.4.33...

Microsoft Dynamics 365 (on-premises) version 8 Cross Site Scripting Vulnerability

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises version 8 does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected...

jQuery File Upload < 9.24.1 Arbitrary File Upload

According to its self-reported version number, jQuery File Upload is prior to 9.24.1. Therefore, it may be affected by an arbitrary file upload vulnerability on a web server that executes files with .php as part of the file extension. An unauthenticated attacker could leverage this vulnerability ...

Netscape Enterprise SnoopServlet servlet cross-site scripting vulnerability

Netscape Enterprise Server is a Web site server that runs on Microsoft, most UNIX, and Linux platforms. A cross-site scripting vulnerability in the servlet/SnoopServlet in Netscape Enterprise version 3.63 can be exploited by a remote, unauthenticated attacker to deliver malicious HTML or JavaScri...