CVE-2019-3799

The CVE-2019-3799 entries describe a Local File Inclusion/Directory Traversal vulnerability in Spring Cloud Config Server. Affected versions are Spring Cloud Config Server 2.1.x before 2.1.2, 2.0.x before 2.0.4, and 1.4.x before 1.4.6, plus older unsupported releases. An unauthenticated attacker ...

CVE-2019-0227

A Server Side Request Forgery SSRF vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2...

Apache Axis Code Execution Vulnerability

Apache Axis is the United States Apache Apache Software Foundation of an open source , XML-based Web services architecture . The product contains a Java and C++ language implementation of the SOAP server , as well as a variety of utility services and APIs to generate and deploy Web services...

Buffer overflow

Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability...

CVE-2015-6457

Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability...

PT-2019-11319 · Jenkins · Jenkins Openid Connect Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenId Connect Authentication Plugin versions 1.4 and earlier Description: A sensitive information exposure issue exists, allowing attackers who can view a Jenkins administrator's web browser output or control the browser to retrieve...

LmxCMS V1.4 SQL Injection Vulnerability in Frontend Bo***.cl***.php

Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name. A SQL injection vulnerability exists in LmxCMS V1.4 frontend Bo.cl.php. An attacker can exploit this vulnerability to obtain sensitive database information...

Evolution CMS Cross-Site Scripting Vulnerability

Evolution CMS is a content management system CMS. A cross-site scripting vulnerability exists in Evolution CMS version 1.4.x, which can be exploited by remote attackers to inject arbitrary web script or HTML by sending the 'search' parameter to the manager/ URI...

GHSA-C289-47QF-RVRR Cross Site Scripting (XSS) vulnerability in easymon

easymon version 1.4 and earlier contains a Cross Site Scripting XSS vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim mus...

Cross site scripting

easymon version 1.4 and earlier contains a Cross Site Scripting XSS vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim mus...

PT-2018-3483 · Graphicsmagick +3 · Graphicsmagick +3

Name of the Vulnerable Software and Affected Versions: GraphicsMagick versions 1.4 snapshot-20181209 Q8 Description: The issue is related to a heap-based buffer overflow in the WriteTGAImage function, which can be exploited by attackers to cause a denial of service. This can be achieved by using ...

cn.net.vidyo:dylink-vidyo-ws-sdk (>=2.1.0.16.RELEASE <=3.0.0.3.RELEASE), com.aftia.plugin:aem-build-maven-plugin.core (>=1.2.1 <=1.2.2) +286 more potentially affected by CVE-2014-3596 via org.apache.axis:axis (=1.4)

org.apache.axis:axis MAVEN version =1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.axis:axis and may be impacted: - cn.net.vidyo:dylink-vidyo-ws-sdk =2.1.0.16.RELEASE, =1.2.1, =1.0.0, =1.4-build003, =0.9.1, =0.0.3.M1, =0.0.3.M1,...

Debian DLA-1427-1 : znc security update

It was discovered that there were two issues in znc, a modular IRC bouncer : - There was insufficient validation of lines coming from the network allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf. CVE-2018-14055 - A path traversal vulnerability via '../'...

Code execution vulnerability in ThinkerCMS v1.4 version

ThinkerCMS is a content management system based on the development of thinkphp3.2, which is characterized by its compactness and delicacy, and can be quickly developed twice. A code execution vulnerability exists in ThinkerCMS v1.4, as the program does not filter webpage Trojan features, attacker...

PT-2018-5351 · Libxls · Libxls

Name of the Vulnerable Software and Affected Versions: libxls version 1.4 Description: An integer overflow issue exists in the xls preparseWorkSheet function when handling a MULBLANK record, allowing a specially crafted XLS file to cause memory corruption and potentially result in remote code...

CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

Design/Logic Flaw

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

CVE-2017-1002101

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type including non-privileged pods, subject to file permissions can access files/directories outside of the volume, including the host's filesyste...

CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

PYSEC-2018-46

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...