Command Execution Vulnerability in EyouCMS v1.4.1

EyouCms is based on TP5.0 framework for the core development of free + open source enterprise content management system , focusing on enterprise station user needs . EyouCMS v1.4.1 there is a command execution vulnerability , attackers can exploit the vulnerability to execute any system command t...

Cisco SPA100 Cross-Site Scripting Vulnerability

The Cisco SPA100 Series is an analog phone adapter from Cisco that allows your standard analog phone to access Internet telephony services through an RJ-11 phone port. A cross-site scripting vulnerability exists in the web-based management interface of Cisco SPA100 Series 1.4.1 SR3 and earlier. T...

Cisco SPA100 Information Disclosure Vulnerability (CNVD-2019-36890)

The Cisco SPA100 Series is an analog phone adapter from Cisco that allows your standard analog phone to access Internet telephony services through an RJ-11 phone port. An information disclosure vulnerability exists in the Web-based management interface of the Cisco SPA100 Series 1.4.1 SR3 and...

Cisco SPA100 Remote Code Execution Vulnerability (CNVD-2019-36891)

The Cisco SPA100 Series is an analog phone adapter from Cisco that allows your standard analog phone to access Internet telephony services through an RJ-11 phone port. A remote code execution vulnerability exists in the Cisco SPA100 Series with firmware 1.4.1 SR4 and earlier. The vulnerability...

Cisco SPA100 Denial of Service Vulnerability

The Cisco SPA100 Series is an analog phone adapter from Cisco that allows your standard analog phone to access Internet telephony services through an RJ-11 phone port. A denial of service vulnerability exists in the web-based management interface of Cisco SPA100 Series 1.4.1 SR3 and earlier. The...

WordPress Motors – Car Dealer & Classified Ads plugin <= 1.4.0 - Multiple security issues

Multiple security issues found by Jerome Bruandet in WordPress Motors – Car Dealer & Classified Ads plugin versions = 1.4.0. Solution Update the WordPress Motors – Car Dealer & Classified Ads plugin to the latest available version at least 1.4.1...

PT-2019-14525 · Kartatopia · Kartatopia Piluscart

Name of the Vulnerable Software and Affected Versions: Kartatopia PilusCart version 1.4.1 Description: The issue arises from the mishandling of the filename parameter in the "catalog.php" file, resulting in a Local File Disclosure vulnerability. This allows for the disclosure of sensitive files o...

Arbitrary Code Execution

Overview Versions of eslint-utils =1.2.0 or 1.4.1 are vulnerable to Arbitrary Code Execution. The getStaticValue does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName...

CVE-2019-11203

The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting XSS and cross-site request...

CVE-2018-16485

Path Traversal vulnerability in module m-server 1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request...

CVE-2018-19862

Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request. NOTE: this product is discontinued...

MiniShare Buffer Overflow Vulnerability

MiniShare is a file sharing system. A buffer overflow vulnerability exists in MiniShare version 1.4.1. An attacker can exploit this vulnerability by sending a long HTTP POST request to execute arbitrary code...

Qutebrowser CSRF Vulnerability

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access qute:// URLs. A malicious website could exploit this to load a qute://settings/set URL, which then sets editor.command to a bash script, resulting in arbitrary code execution...

qutebrowser Cross-Site Request Forgery Vulnerability

qutebrowser is a keyboard-based open source browser with a graphical interface. A cross-site request forgery vulnerability exists in qutebrowser versions prior to 1.4.1. A remote attacker can exploit this vulnerability to execute arbitrary code with the help of a malicious website...

PYSEC-2018-27

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect WebSphere Application Server April 2016 CPU (CVE-2016-3426, CVE-2016-3427) shipped with Tivoli Netcool Performance Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the Oracle April 2016 Critical Patch Update, plus four additional vulnerabilities. These may affect some configurations of IBM...

mruby buffer overflow vulnerability

mruby is a lightweight implementation of the Ruby language. A heap buffer overflow vulnerability exists in mruby version 1.4.1, which stems from the failure of the mrbgems/mruby-fiber/src/fiber.c file to have room to extend the stack when a large number of parameters are passed to fiber. An...

mruby Denial of Service Vulnerability (CNVD-2018-12149)

mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in mruby version 1.4.1 in mrbclass. An attacker can exploit this vulnerability to cause a denial of service crash...

Design/Logic Flaw

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content...

Out-of-bounds Read

Overview Versions of byte before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length Recommendation Update to version 1.4.1 or later. References - HackerOne Report - PR 3 - GitHub Advisory...