YouPHPTube SQL Injection Vulnerability

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in YouPHPTube version 7.6, which stems from a lack of validation of externally entered SQL statements in database-based applications, and can be exploited by attackers to execute illegal SQL commands...

TOPMeeting SQL Injection Vulnerability

TOPMeeting is a video conferencing solution. A SQL injection vulnerability exists in versions prior to TOPMeeting 8.8 2019/08/19. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit the vulnerability to...

YouPHPTube videoAddNew.json.php file SQL injection vulnerability

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in the /objects/videoAddNew.json.php file in YouPHPTube version 7.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit...

SonarSource SonarQube Cross-Site Scripting Vulnerability

SonarSource SonarQube is an open source code quality management system from SonarSource Switzerland. A cross-site scripting vulnerability exists in project links in SonarSource SonarQube versions prior to 7.8. The vulnerability stems from a lack of proper validation of client-side data by the WEB...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36913)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

MetInfo SQL Injection Vulnerability (CNVD-2020-14278)

MetInfo is a content management system CMS developed by China Mito MetInfo using PHP and Mysql. A SQL injection vulnerability exists in MetInfo 7.0.0 beta, which stems from a lack of validation of externally entered SQL statements in database-based applications and can be exploited by an attacker...

phpBB cross-site request forgery vulnerability (CNVD-2019-34464)

phpBB is a set of open source and PHP-based Web forum software . The software has support for multiple languages , multiple databases and customized layout and so on. A cross-site request forgery vulnerability exists in phpBB, which arises from a WEB application that does not adequately validate...

michaelkuyperart.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-984681 Security Researcher devl00p Helped patch 2974 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting michaelkuyperart.com...

m.johnboylawncare.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-984388 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Centreon SQL Injection Vulnerability

Centreon Merethis Centreon is an open source IT monitoring software package from Centreon France that needs to be used with Nagios. The software enables the management of Nagios via the Web, as well as the monitoring of networks, operating systems and applications via third-party components. A SQ...

CloudBees Jenkins and LTS Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . LTS is a long-term support for...

Design/Logic Flaw

An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization e.g., a basename call for a pathname to filegetcontents or fileputcontents...

fineartabstract.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-974583 Security Researcher devl00p Helped patch 3018 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting fineartabstract.com websi...

Command Injection in gitlabhook

All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative...

CVE-2019-1235

An elevation of privilege vulnerability exists in Windows Text Service Framework TSF when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'...

FreeType Buffer Overflow Vulnerability (CNVD-2019-30720)

FreeType is an open source font rendering library written in the C language. A buffer overflow vulnerability exists in the skipcomment file in psaux/psobjs.c in versions of FreeType prior to 2.6.1. The vulnerability stems from a networked system or product performing operations in memory without...

Local File Inclusion

larvitbase-www is vulnerable to local file inclusion. The package uses an exposed API endpoint that accepts an unvalidated GET parameter to a require function call. This could potentially allow a remote attacker to execute any .js files within the web server. Successful exploitation causes the...

Lute-Tab Buffer Overflow Vulnerability

Lute-Tab is a utility program for editing sound scores. A buffer overflow vulnerability exists in Lute-Tab. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting in incorrect read and write operations bein...

Ping Identity Agentless Integration Kit Cross-Site Scripting Vulnerability

Ping Identity Agentless Integration Kit is an agentless authentication development kit from Ping Identity. A cross-site scripting vulnerability exists in Ping Identity Agentless Integration Kit versions prior to 1.5. The vulnerability stems from the lack of proper validation of client-side data b...

Buffer overflow vulnerability in Linux kernel

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A buffer overflow vulnerability exists in the Linux kernel. The vulnerability arises from a networked system or product performing operations in memory without properl...