qinggan phpok 代码问题漏洞

phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. An arbitrary file write vulnerability exists in the editsavef function in framework/admin/tplcontrol.php in phpok version 5.1. An attacker can exploit this vulnerability to wri...

qinggan phpok 缓冲区错误漏洞

phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. A buffer overflow vulnerability exists in framework/init.php in phpok version 5.1. An attacker can exploit this vulnerability to execute arbitrary code...

OESA-2021-1391 rubygem-activeresource security update

REST on Rails. Wrap your RESTful web app with Ruby classes and work with them like Active Record models. Security Fixes: There is a possible information disclosure issue in Active Resource v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way...

CVE-2021-34348

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later...

CVE-2021-34349

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later...

SeedDMS 跨站请求伪造漏洞

SeedDMS formerly known as LetoDMS and MyDMS is a set of open source document management system based on PHP and MySql . The system is primarily used for storing and sharing documents. A cross-site request forgery vulnerability exists in SeedDMS v5.1.x 5.1.23 and v6.0.x 6.0.16. A remote attacker...

PT-2021-14500 · Unknown · Openapi-Generator-Online

Name of the Vulnerable Software and Affected Versions: openapi-generator-online versions prior to 5.1.0 Description: The openapi-generator-online tool creates insecure temporary folders during the code generation process, allowing any user on the system to read and append to the auto-generated...

NXP MCUXpresso Software Development Kit 输入验证错误漏洞

The NXP MCUXpresso Software Development Kit is an application system from the Dutch company NXP. It is used to simplify and accelerate the development of applications with ARM's Cortex NXP-M based devices, including general purpose, crossover and Bluetooth microcontrollers. An input validation...

PT-2021-7607 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: Multiple code execution vulnerabilities exist in the Nef polygon-parsing functionality. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could lead to code...

IBM API Connect 资源管理错误漏洞

BM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping customers reduce storage costs while improving security and management efficiency in...

pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.

...

PT-2020-16210 · Typesetter · Typesetter Cms

Name of the Vulnerable Software and Affected Versions: Typesetter CMS versions 5.x through 5.1 Description: The issue allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. This behavior contradicts the security policy, and the vendor is fixing it for version...

CVE-2020-9682

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary file system write...

CVE-2020-9670

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2020-9669

Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privilege escalation...

Cheetah free wifi input validation error vulnerability

Cheetah free wifi is a calculator wireless network sharing software from China Cheetah Mobile Cheetah. An input validation error vulnerability exists in the liebaonat.sys file in Cheetah free wifi version 5.1, which originates from the program not validating the input value of IOCtl 0x830020f8,...

Typesetter Cross-Site Request Forgery Vulnerability (CNVD-2020-03269)

Typesetter is a content management system CMS. A cross-site request forgery vulnerability exists in the opt-out feature in Typesetter version 5.1. The vulnerability stems from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could use...

Oracle Database Server Application Express Component Access Control Error Vulnerability

Oracle Database Server is the United States Oracle Oracle a set of relational database management system. The database management system provides data management, distributed processing and other functions. Application Express APEX, formerly known as HTML DB is one of the Web applications for the...

DEBIAN-CVE-2019-1010315

WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig dsdiff.c:282. The attack vector is: Maliciously crafted .wav file. The fixed...

Typesetter Cross-Site Scripting Vulnerability

Typesetter is a content management system CMS. A cross-site scripting vulnerability exists in Typesetter version 5.1, which stems from a lack of proper validation of client-side data in the web application and can be exploited by an attacker to execute client-side code...