CVE-2020-15944

An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...

SpringBlade SQL Injection Vulnerability

SpringBlade is a set of microservices development platform. A SQL injection vulnerability exists in the DAO/DTO implementation in SpringBlade 2.7.1 and earlier versions. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-43609)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxadminapis.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate user-supplied strings before executing system calls. ...

Gambio GX SQL Injection Vulnerability

Gambio GX is a suite of e-commerce platforms from Gambio Germany. A SQL injection vulnerability exists in the admin/mobile.php file in Gambio GX versions prior to 4.0.1.0. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An...

CVE-2020-15477

The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the childprocess.exec function...

CVE-2020-10922

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issu...

Apache Kylin SQL Injection Vulnerability

Apache Kylin is the United States Apache Apache Software Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. A SQL injection vulnerability exists in...

Glacies IceHRM SQL Injection Vulnerability

Glacies IceHRM is a human resource management system from the Glacies team in Germany. The system includes features such as expense management, recruitment management, payroll management and leave management. A SQL injection vulnerability exists in the Admin Reports feature in Glacies IceHRM...

CVE-2020-5970

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of service. This affects vGPU version 8.x prior to 8.4, version 9.x prior to 9.4 and version 10.x prior to 10.3...

WordPress Nexos theme SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.Nexos theme is a real estate website theme plugin used in it. WordPress Nexos theme has a SQL injection vulnerability. The...

CVE-2020-15017

NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...

CVE-2020-11520

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution...

PHP-Fusion SQL Injection Vulnerability (CNVD-2020-52839)

PHP-Fusion is a Malaysian PHP-Fusion company based on MySql and PHP open source lightweight content management system . The system contains modules such as news, articles and forums. A SQL injection vulnerability exists in the administration/comments.php endpoint in PHP-Fusion version 9.03.50. Th...

Mattermost Server SQL Injection Vulnerability

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A SQL injection vulnerability exists in Mattermost Server, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an attack...

Jason2605 AdminPanel SQL Injection Vulnerability

Jason2605 AdminPanel is a database administration panel. Jason2605 AdminPanel suffers from a SQL injection vulnerability. The vulnerability stems from a database-based application that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute...

Wordpress LearnPress SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.LearnPress is a learning management system plugin used in it. A SQL injection vulnerability exists in Wordpress LearnPress...

The vulnerability of the Symfony software platform for developing and managing web applications stems from insufficient validation of input data, allowing attackers to compromise data integrity.

The vulnerability of the Symfony software development and management platform is related to an application error where unvalidated user input is passed as a file. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

Cross-site scripting vulnerability in multiple NETGEAR products (CNVD-2020-26945)

NETGEAR D7800 and others are products of NETGEAR, Inc.NETGEAR D7800 is a wireless modem.NETGEAR R7500 is a wireless router.NETGEAR XR500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless...

ViewVC Cross-Site Scripting Vulnerability (CNVD-2020-33722)

ViewVC is a Web-based CVS, SVN code repository browsing tool . A cross-site scripting vulnerability exists in ViewVC versions prior to 1.1.28 and 1.2.1. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability...

Command Injection

Overview npm-programmatic is a library that allows you to access npm commands programmatically from javascript. Affected versions of this package are vulnerable to Command Injection. The packages and option properties are concatenated together without any validation and are used by the exec...