File Upload Vulnerability in B2C (Self-operated) Version of Mall

B2C self-operated version of the mall is a set of self-operated e-commerce system software for merchants developed by Yunmai E-commerce Co. A file upload vulnerability exists in the B2C self-managed version of Mall, which can be exploited by attackers to gain control of the web server...

Command Execution Vulnerability in RGCMS

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS has a command execution vulnerability that can be exploited by attackers to gain control of the web...

Command Execution Vulnerability in Fastjson JtaTransactionConfig

fastJson is a json serialization tool produced by Alibaba . Fastjson JtaTransactionConfig has a command execution vulnerability that can be exploited by a remote attacker to construct attack code that triggers a remote code execution vulnerability and gain control of the server...

Webshell bypass vulnerability exists in D Shield (CNVD-2020-22802)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability, which can be exploited by attackers to gain control of the target server...

Webshell bypass vulnerability exists in D Shield (CNVD-2020-22804)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability, which can be exploited by attackers to gain control of the target server...

Webshell bypass vulnerability exists in D Shield (CNVD-2020-22803)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability, which can be exploited by attackers to gain control of the target server...

D Shield suffers from a webshell bypass vulnerability (CNVD-2020-22800)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised with internal and external protection. D-Shield suffers from a webshell bypass vulnerability, which can be exploited by attackers to gain control of the target server...

Biscom Secure File Transfer (SFT) Remote Code Execution Vulnerability

Biscom Secure File Transfer SFT is a Web-based file transfer solution from Biscom Inc. in the United States. The program features file sharing, workspace creation and automatic file cleanup. A remote code execution vulnerability exists in Biscom Secure File Transfer SFT. An attacker could exploit...

CVE-2020-2679

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Code injection

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2020-2588

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

Thinkphp5 applet one-click generation platform has file upload vulnerability

Thinkphp5 small program one-click generation platform is a small program one-click generation system source code. A file upload vulnerability exists in Thinkphp5 Applet One Click Generation Platform. An attacker can exploit this vulnerability to upload a webshell and gain server privileges...

CVE-2020-2551

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP...

CVE-2019-20155

An issue was discovered in reportedit.jsp in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server...

MTN Group: Java Debug Console Provides Command Injection Without Privellage Esclation

Summary: I intially found the debug console as a tool to insert arbitrary html/xss bugs, however after further probing the debug console it has some serious security flaws to allow arbitrary java code to be executed. My intial report of a seperate bug using this console,...

Code Execution Vulnerability in XYHCMS Backend

XYHCMS is an open source CMS content management system. There is a code execution vulnerability in the background of XYHCMS, which can be exploited by an attacker to add malicious code in site.php, so that the attacker can gain access to the target terminal...

Webshell bypass vulnerability exists in D Shield (CNVD-2020-03915)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability, which can be exploited by attackers to gain control of the target server...

File Containment Vulnerability in Huake Network Enterprise Management System

Huake Enterprise Management System is an intelligent website builder based on PHP+MySQL, with only one set of templates, 3 channel models + 1 detail model, and no duration of use or functionality limitations. Huake Network Enterprise Management System has a file inclusion vulnerability, which can...

Webshell Bypass Vulnerability in D-Shield_Firewall

D-ShieldFirewall is an active defense protection software designed for IIS, to protect websites and servers from intrusion by internal and external protection. D-ShieldFirewall has a webshell bypass vulnerability that can be exploited by an attacker to gain control of the target server...

CVE-2019-19902

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, allowing non-configuration scripts to...