Command injection

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

Information Disclosure

hawtio-system is vulnerable to an information disclosure. The library displays the entire stack trace when it runs into an exception in accessing a non-existent directory, allowing a malicious user to gather sensitive information from it...

Unauthorized Access Vulnerability in YCCMS v3.3 System

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. YCCMS v3.3 system has an unauthorized access vulnerability, which can be exploited by attackers to directly access the background without logging in and perform any operation ...

Arbitrary File Download Vulnerability in HDWiki System Backend Database

Interactive Wiki open source system HDwiki is by the interactive online Beijing Technology Co., Ltd. launched a free wiki Wiki building system. HDWiki system background database there are arbitrary file download vulnerability. Attackers can exploit the vulnerability to download the core...

CVE-2018-12153

Intel Graphics Driver (Unified Shader Compiler) in Windows contains CVE-2018-12152, CVE-2018-12153, and CVE-2018-12154 affecting 4th/5th Gen Intel HD Graphics. LEN-24426/PS500197 state input sanitization issues may allow elevation of privilege or denial of service via crafted shaders; mitigation ...

CVE-2018-1649

IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 144655...

UBUNTU-CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

Google Android System Elevation of Privilege Vulnerability (CNVD-2019-03707)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, of which System is a component. An elevation of privilege vulnerability exists in System in Android versions 8.0 and 8.1. An attacker can exploit this vulnerability to elevate...

The vulnerability of the Windows Installer component on Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Windows Installer component in Windows operating systems is related to errors during library loading. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2018-15912

An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. A local attacker can install or remove arbitrary packages and package repositories potentially containing hooks with arbitrary code, which will automatically be run as root, or remove packages vital...

Google Android System Denial of Service Vulnerability (CNVD-2018-18776)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A denial of service vulnerability exists in System in Android. An attacker can exploit this vulnerability to cause a denial of service...

Google Android System Information Disclosure Vulnerability (CNVD-2018-18766)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An information disclosure vulnerability exists in System in Android version 8.0 and 8.1. An attacker can exploit this vulnerability to obtain information...

Google Android System Elevation of Privilege Vulnerability (CNVD-2018-18773)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in System in Android. An attacker can exploit this vulnerability to elevate privileges...

DEBIAN-CVE-2018-14593

An issue was discovered in Open Ticket Request System OTRS 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL...

Cross site scripting

system/editbook.php in XYCMS 1.7 has stored XSS via a crafted adddo.php request, related to addbook.php...

Information disclosure

IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2.6 could allow an unauthenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 145180...

DEBIAN-CVE-2017-16816

The condorschedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service daemon crash by leveraging use of GSI and VOMS extensions...

CVE-2018-9242

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via specific request parameters...

Cisco Unified Computing System Local Command Injection Vulnerability (CNVD-2018-13560)

Cisco Unified Computing System UCS Software is a set of unified computing system of the United States Cisco Cisco. The system through the extensive use of virtualization technology will be integrated into a platform of network, computing and virtualization resources. A local command injection...

CVE-2018-4861

A vulnerability has been identified in SCALANCE M875 All versions. An authenticated remote attacker with access to the web interface 443/tcp, could potentially read and download arbitrary files from the device's file system. Successful exploitation requires that the attacker has network access to...