CVE-2018-20129: DedeCMS V5. 7 SP2 front Desk file upload getshell vulnerability alerts-a vulnerability alert-the black bar safety net

2018-12-11 in CVE Chinese application station published a DEDECMS 5.7 SP2 is the latest version there is a file upload vulnerability, with administrator privileges can exploit this vulnerability to upload and getshell execute arbitrary PHP code. After analysis and verification. The vulnerability...

CVE-2018-7991

Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110C00 have a Factory Reset Protection FRP bypass vulnerability. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific...

Huawei Mate10 FRP Bypass Vulnerability

Huawei Mate10 is a smartphone product. Huawei Mate10 suffers from FRP bypass vulnerability. Due to the system's failure to adequately check permissions, an attacker using a data cable to connect the phone to a computer can bypass the phone's FRP protection and enter the system settings page after...

FortiWeb Recursive URL Decoding is not enabled by default

FortiWeb's "Recursive URL Decoding" feature can detect URL-based attacks among which XSS and SQL injection attempts even when the malicious URL is recursively encoded. However, this feature is not enabled by default in FortiWeb's system settings for FortiWeb version 6.0.0 and below...

Cross site scripting

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...

Cross site scripting

Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors...

CVE-2018-0558

Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors...

CVE-2018-0558

Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settings' via unspecified vectors...

CVE-2018-0558

Cybozu Mailwise 5.0.0–5.4.1 contains a reflected cross-site scripting (CWE-79) vulnerability in System settings, enabling injection of arbitrary script or HTML and potential session-local impact. The issue is confirmed across multiple sources (CVE-2018-0558 and related records). Attack vectors ar...

Security Bulletin: IBM QRadar SIEM does not enforce session expiry. (CVE-2015-2005)

Summary Session Expiry not enforced by default in IBM QRadar SIEM Vulnerability Details CVE-ID: CVE-2015-2005 Description: IBM QRadar SIEM could allow a local user to obtain sensitive information due to session expiration not being enforced. A user on the machine could obtain information from the...

EasyService Billing Cross-Site Request Forgery Vulnerability (CNVD-2018-10564)

EasyService Billing is a PHP-based service-oriented consumer business management system . A cross-site request forgery vulnerability exists in the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing version 1.0. A remote attacker can exploit this vulnerability to ad...

Cross site request forgery (csrf)

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11445

CVE-2018-11445: EasyService Billing 1.0 has a CSRF vulnerability in the User Add/System Settings page (system-settings-user-new2.php) that allows a user to be added with the Admin role. Exploitation is evidenced by multiple connected records (Exploit-DB entry and CNVD/CVE mirrors) describing a CS...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

Multiple cross-site scripting vulnerabilities in Cybozu Mailwise

Overview Cybozu Mailwise contains multiple cross-site scripting vulnerabilities below. Stored cross-site scripting vulnerability in "E-mail Details Screen" CWE-79 - CVE-2018-0557 Reflected cross-site scripting vulnerability in "System settings" CWE-79 - CVE-2018-0558 Reflected cross-site scriptin...

Cybozu Mailwise Cross-Site Scripting Vulnerability (CNVD-2018-15282)

Cybozu Mailwise is a Web-based e-mail system from Cybozu, and System settings is one of the system settings components. A cross-site scripting vulnerability exists in System settings in Cybozu Mailwise versions 5.0.0 through 5.4.1. A remote attacker can use this vulnerability to inject arbitrary...

CVE-2018-6020

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

CVE-2018-6020

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...

Authentication flaw

In Silex SX-500 all versions and GE MobileLinkGEH-500 version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings...