PowerDNS Recursor Denial of Service Vulnerability (CNVD-2018-23738)

PowerDNS Recursor aka pdnsrecursor is a domain name resolution server from the Dutch company PowerDNS. A security vulnerability exists in PowerDNS Recursor versions 4.0.0 through 4.1.4. A remote attacker can exploit this vulnerability by sending DNS queries to cause a denial of service...

DEBIAN-CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

libgig heap buffer overflow vulnerability (CNVD-2018-15174)

libgig is a C++ library for loading, modifying existing and creating new Gigasampler .gig files and DLS downloadable sound level 1/2 files, KORG sample-based instruments .KSF and .KMP files, SoundFont v2 .sf2 files and AKAI sampler data. A heap-based buffer overflow vulnerability exists in the...

ACD Systems Canvas Draw Buffer Overflow Vulnerability (CNVD-2019-06632)

ACD Systems Canvas Draw is a graphic editing tool from ACD Systems that is used to create and edit images and more. A heap buffer overflow vulnerability exists in the TIFF parsing feature in ACD Systems Canvas Draw version 4.0.0, which can be exploited by an attacker to overwrite arbitrary data a...

PT-2018-16263 · Acd Systems · Canvas Draw

Name of the Vulnerable Software and Affected Versions: Canvas Draw version 4.0.0 Description: An out-of-bounds write exists in the PCX parsing functionality. A specially crafted PCX image can lead to an out-of-bounds write, overwriting arbitrary data, and potentially allowing an attacker to gain...

SAP Business Objects Remote Code Injection Vulnerability

SAP Business Objects is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The program provides reporting, performance management and data base and other functions. A remote code injection vulnerability exists in SAP Business Objects, version 4.0 4.1...

File Upload Vulnerability in BEESCMS Enterprise Website Management System V4.0

BEESCMS is a scalable content management system CMS based on PHP and MySQL. A file upload vulnerability exists in BEESCMS Enterprise Website Management System V4.0. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Ximdex cross-site scripting vulnerability (CNVD-2018-14422)

Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition, etc. The DMS component is one of the data management components. A cross-site scripting vulnerability exists in the /edit URI of...

Trovebox Insecure Password Reset Token Generation Vulnerability

Trovebox is an open source image sharing and management platform. user is one of the user components. A security vulnerability exists in the user component of Trovebox prior to version 4.0.0-rc6, which stems from the program failing to create a secure password reset token. An attacker can exploit...

Code Execution Vulnerability in MaxCMS Version 4.0

Movie System Max Program MaxCMS is an open source program that specializes in serving the construction of movie websites. MaxCMS 4.0 version of the existence of code execution vulnerabilities, the vulnerability stems from the website configuration parameters are modified without filtering the...

SQL Injection Vulnerability in MaxCMS Version 4.0

Movie System Max Program MaxCMS is an open source program that specializes in serving the construction of movie websites. MaxCMS version 4.0 suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

Arbitrary File Upload Vulnerability in Monxin v4.0

Monxin mall system is a mall management system based on PC mall + mobile mall + WeChat mall + offline cashier, members / orders / commodities / inventory online and offline real-time synchronization of data across the network. Monxin v4.0 suffers from an arbitrary file upload vulnerability, which...

Website Security Dog (Apache Edition) V4.0 suffers from SQL injection vulnerability (CNVD-2018-02087)

Website Security Dog Apache Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection features. Web Security Dog Apache Edition V4.0 suffers from a SQL injection vulnerability. Allows attackers to exploit the...

Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in multiple repositories in Atlassian FishEye...

LibTIFF 'TIFFReadDirEntryArray' Function Denial of Service Vulnerability

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A security vulnerability exists in the 'TIFFReadDirEntryArray' function in the tifread.c fil...

CVE-2017-1338

IBM DOORS Next Generation DNG/RRC 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

Red Hat CloudForms ManageIQ Remote Code Execution Vulnerability

Red Hat CloudForms is a suite of IaaS Infrastructure as a Service cloud services solutions from Red Hat. The solution creates and manages private and public clouds, and has the ability to manage the application lifecycle.ManageIQ is one of the virtualization managers. A security vulnerability...

UBUNTU-CVE-2017-10788

The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service use-after-free and application crash or possibly have unspecified other impact by triggering 1 certain error responses from a MySQL server or 2 a loss of a network connection to a MySQL server. The...

Five fingers CMS system s parameters exist arbitrary file download vulnerability

Five Fingers CMS is an open source content management system suitable for portals, corporate website builders, mobile websites and microblogging promotion. Five Fingers CMS system version 4.0.0 there are arbitrary file download vulnerabilities. Due to the failure of effective filtering parameters...

PT-2017-17974 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue is related to a Cross-Site Scripting XSS problem. It occurs in the doli/societe/list.php file through the sall parameter. This allows for potential malicious script injection...