Path traversal

Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component...

CVE-2020-17563

Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id="...

GHSA-9Q69-G5GC-9FGF Cross-Site Request Forgery in Vert.x-Web framework

Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need t...

CVE-2020-21224

A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server...

Security Bulletin: HAProxy vulnerability CVE-2020-11100 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0

Summary HAProxy vulnerability CVE-2020-11100 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0. The fix for this set of vulnerabilities was delivered in IBM Aspera High-Speed Transfer Server V4.0.0 and IBM Aspera High-Speed Transfer...

Code injection

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7...

CVE-2019-20923

Removed by vendor...

PCI DSS version 4.0 – what we know so far

From September 23 - November 13, 2020, stakeholders can participate in the Request for Comments RFC on the draft of PCI Data Security Standard DSS version 4.0. This is the second RFC for the PCI DSS v4.0 draft--the first RFC was in late 2019 and that feedback was incorporated into the draft...

CVE-2020-5193

PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter...

CVE-2020-5191

PHPGurukul Hospital Management System in PHP v4.0 is affected by multiple Persistent XSS (Cross‑Site Scripting) vulnerabilities, as documented by CVE-2020-5191. The cited sources consistently describe the issue as client-side script injections that could be executed in the context of the affected...

AutoSploit v4.0 - Automated Mass Exploiter

As the name might suggest AutoSploit attempts to automate the exploitation of remote hosts. Targets can be collected automatically through Shodan, Censys or Zoomeye. But options to add your custom targets and host lists have been included as well. The available Metasploit modules have been select...

CVE-2019-2389

CVE-2019-2389 affects MongoDB Server via incorrect scoping of kill operations in packaged SysV init scripts. The flaw lets users with write access to the PID file influence kills when the root user stops MongoDB, enabling denial-of-service conditions. Affected are MongoDB Server v4.0 prior to 4.0...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2016 - Includes Oracle Jan 2016 CPU affect Content Collector for Email

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for Email. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin:IBM SDK, Java Technology Edition Quarterly CPU - Apr 2016 - Includes Oracle Apr 2016 CPU affect for IBM Connections

Summary There is vulnerability in IBM® SDK Java™ Technology Edition, Java™ Version 6 and Java™ Version 7 that is used by Content Collector for IBM Connections.This issue was disclosed as part of the IBM Java SDK updates in January 2016 Vulnerability Details CVEID: CVE-2016-0264 DESCRIPTION: A...

CVE-2019-10979

SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password...

Default credentials

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change...

CVE-2019-11018

ThinkAdmin V4.0 contains a vulnerability in the file application/admin/controller/User.php where administrator cookie-based credentials remain valid after a password change. The affected software/version is ThinkAdmin 4.0; root cause is improper invalidation of existing login cookies upon passwor...

CVE-2019-11018

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials after a password change...

CVE-2018-18927

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...

Design/Logic Flaw

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...