MKCMS Cross-Site Request Forgery Vulnerability

MKCMS is a content management system. A cross-site request forgery vulnerability exists in MKCMS version 5.0. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker can exploit the vulnerability to send an...

CVE-2019-10631

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

MKCMS SQL Injection Vulnerability

MKCMS is a content management system. A SQL injection vulnerability exists in MKCMS version V5.0. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL commands...

Unspecified vulnerability in Apple watchOS Passcode component

Apple watchOS is an operating system for smartwatches from Apple.Passcode is one of the cryptographic components. A security vulnerability exists in the Passcode component of Apple watchOS versions prior to 5.2, which stems from a failure to erase an entered passcode after the device enters sleep...

PT-2019-4499 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.1 Description: The issue is related to a memory leak in the feat register sp function, which may cause denial of service. This is due to an uncontrolled resource consumption. Recommendations: For Linux kernel...

PT-2019-19408 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions prior to 5.5.11 Description: A cross-site scripting XSS issue allows attackers to inject arbitrary web script or HTML via the xiwindow parameter. This could potentially lead to unauthorized actions on the affected system...

Adrenalin eSystems HRMS Software Cross-Site Scripting Vulnerability

Adrenalin eSystems HRMS Software is a human resource management system from Adrenalin eSystems India. A cross-site scripting vulnerability exists in the RPT/SSRSDynamicEditReports.aspx page in Adrenalin eSystems HRMS Software version 5.4. A remote attacker can exploit this vulnerability to inject...

kernel: net/rxrpc: overflow in decoding of krb5 principal

Keberos 5 tickets being decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation...

CVE-2019-0276

Banking services from SAP 9.0 FSAPPL version 5 and SAP S/4HANA Financial Products Subledger S4FPSL, version 1 performs an inadequate authorization check for an authenticated user, potentially resulting in escalation of privileges...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2019-07929)

YzmCMS is an open source CMS Content Management System by Yuan Zhimeng programmers in China. A cross-site scripting vulnerability exists in YzmCMS version 5.2. A remote attacker can use the 'column name' parameter of admin/category/edit.html page to inject arbitrary Web script or HTML with the he...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2019-07930)

YzmCMS is an open source CMS Content Management System by Yuan Zhimeng programmers in China. A cross-site scripting vulnerability exists in YzmCMS version 5.2. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML with the help of the 'configuration value'...

McAfee Agent Information Disclosure Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. An information disclosure vulnerability exists in the remote login feature in McAfee MA version 5.x. A remote attack...

File Upload Vulnerability in DedeCMS V5.7

DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. DedeCMS V5.7 file upload vulnerability, a...

DedeCMS V5.7 Arbitrary File Deletion Vulnerability

DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. DedeCMS V5.7 arbitrary file deletion...

Apache Jmeter Remote Code Execution Vulnerability

Apache Jmeter is the United States Apache Apache Software Foundation of a set of open source software written in Java language for stress testing and performance testing . A remote code execution vulnerability exists in Apache Jmeter versions 4.0 and 5.0. A remote attacker can exploit this...

PT-2019-6134 · Bluez +2 · Bluez +2

Name of the Vulnerable Software and Affected Versions: BlueZ versions through 5.48 Description: A heap-based buffer overflow was discovered in the bluetoothd component of BlueZ. The issue is caused by the lack of size checks when appending data to the output buffer in the service attr req functio...

Laravel Framework Illuminate Component Deserialization Vulnerability

Laravel Framework is a PHP-based web application development framework developed by Taylor Otwell Software Developers.Illuminate is one of the components. A deserialization vulnerability in the Illuminate component in Laravel Framework version 5.7.x can be exploited by remote attackers to execute...

CVE-2018-1947

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

file 'readelf.c' stack buffer out-of-bounds read vulnerability

file is a command-line tool used on Unix-like systems to view file information. A stack buffer out-of-bounds read vulnerability exists in docorenote in the readelf.c file of the libmagic.a static link library in file version 5.35. The vulnerability allows remote attackers to submit a special file...

file do_core_note Denial of Service Vulnerability

file is a command-line tool used on Unix-like systems to view file information. A security vulnerability exists in the docorenote file of the readelf.c file of the libmagic.a static link library in file version 5.35. A remote attacker could use this vulnerability to cause a denial of service stac...