CVE-2018-12914

A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...

Sql injection

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

CVE-2018-12912

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

CVE-2018-12914

A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...

Information disclosure

SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverterinfo.htm or englishmain.htm URI...

Cross site scripting

Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...

Cross site scripting

Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...

CVE-2018-12655

Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...

CVE-2018-12656

Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...

CVE-2018-12655

Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

Sql injection

NEWMARK aka New Mark NMCMS 2.1 allows SQL Injection via the sectid parameter to the /catalog URI...

CVE-2018-12630

NEWMARK aka New Mark NMCMS 2.1 allows SQL Injection via the sectid parameter to the /catalog URI...

CVE-2018-12630

CVE-2018-12630 affects NEWMARK NMCMS 2.1. The issue is a SQL Injection in the sect_id parameter of the /catalog URI, allowing an attacker to execute arbitrary SQL commands. Impact is high/critical (CVSS3 base 9.8; no auth, network access, no user interaction). Root cause: improper handling of use...

Cross site request forgery (csrf)

An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI...

Open a file or URL on the target computer

This module will open any file or URL specified with the URI format on the target computer via the embedded commands such as 'open' or 'xdg-open'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Cross-site Scripting (XSS)

javamelody-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization in the counter parameter when performing the clearcounter action through the /monitoring URI, causing XSS attacks...

Fedora 27 : nodejs-JSV / nodejs-uri-js (2018-13e08f4b4a)

Update to latest nodejs-uri-js for CVE fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora Update for nodejs-uri-js FEDORA-2018-13e08f4b4a

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-12104

Cross-site scripting XSS vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/newreport.kp URI...