Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit

Exploit for java platform in category web applications Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version: JReport 15.6 Tested on...

Osmand Code Issue Vulnerability

Osmand is a mapping and navigation application for mobile platforms. A code issue vulnerability exists in Osmand 2.0.0 and prior versions. The vulnerability stems from an improperly designed or implemented code development process for a networked system or product. No detailed vulnerability detai...

Positive Academic Affairs system has information leakage vulnerability

Ltd. is a software enterprise and high-tech enterprise specializing in consulting, planning, construction and service in the field of university education informatization. There is an information leakage vulnerability in the Zhengfang Academic Affairs System, which can be exploited by attackers t...

Shanghai Danfan Network Technology Co., Ltd. builds website system with SQL injection vulnerability (CNVD-2020-26554)

Shanghai Danfan Network Technology Co., Ltd. is for the chemical industry to provide B2B e-commerce platform of professional website. Shanghai Danfan network science and technology limited company builds the station system exists the SQL injection loophole, the attacker may utilize the loophole...

The vulnerability of the Linux operating system, related to insecure management of privileges, allows a perpetrator to execute arbitrary code.

The vulnerability of the Linux operating system is related to insecure management of privileges. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Google Android System Out-of-Bounds Write Vulnerability (CNVD-2020-17464)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in System in Android version 10.0. The vulnerability can be exploited by an attacker to elevate privileges...

The vulnerability of the Win32k component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k component of the Windows operating system is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to increase their privileges...

Android System Elevation of Privilege Vulnerability (CNVD-2020-16081)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in System in Android 9. A local attacker can exploit the vulnerability with the help of specially crafted files t...

Android System Denial of Service Vulnerability (CNVD-2020-16084)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in System in Android version 10. An attacker could exploit this vulnerability to cause a denial of service...

CVE-2020-3861

The issue was addressed with improved permissions logic. This issue is fixed in iTunes for Windows 12.10.4. A user may gain access to protected parts of the file system...

Cisco IOS XR Resource Management Error Vulnerability (CNVD-2020-14349)

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. A security vulnerability exists in Cisco IOS XR. The vulnerability stems from mismanagement of system resources e.g., memory, disk space, files, etc. by the network system or produc...

Shanghai Zhaoliang Network Technology Co., Ltd. website building system has SQL injection vulnerabilities

Shanghai Zhaoran Network Technology Co., Ltd. is an IT company specializing in website construction and promotion, software development, large-scale e-commerce platform construction and operation. Shanghai Zhaoran Network Technology Co., Ltd. website construction system SQL injection vulnerabilit...

SQL injection vulnerability in re***.php file of Tuan Ah VIP movie system

Group ah VIP movie system is a set of registered members with proxy version of the VIP movie video watching website source code. There is a SQL injection vulnerability in the re.php file. Attackers can use the vulnerability to obtain sensitive information in the database...

Oracle Linux 8 : grub2 (ELSA-2020-0335)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0335 advisory. 2.02-78.0.3.el81.1 - honor /etc/sysconfig/kernel DEFAULTKERNEL setting for BLS Orabug: 30643497 - set EFIDIR as redhat for additional grub2 tools Orabug: 298755...

IBM WebSphere Application Server Denial of Service (CVE-2019-4720)

The IBM WebSphere Application Server running on the remote host is version 7.0.x prior or equal to 7.0.0.45, 8.0.x prior or equal to 8.0.0.15, 8.5.0.x prior to 8.5.5.18, or 9.0.x prior to 9.0.5.3 It is, therefore, affected by aa denial of service vulnerability. An unauthenticated remote attacker...

CVE-2019-4674

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 171510...

Spoofing

IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing ...

Code injection

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directorie...

Code injection

In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker non-admin can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP...

Arbitrary Code Execution

ansible is vulnerable to arbitrary code execution. An attacker is able to execute arbitrary code on the system by passing malicious strings that will be evaluated and executed by the safeeval function...