PublicCMS Path Traversal Vulnerability

PublicCMS is an open source content management system CMS written in Java. A directory traversal vulnerability exists in PublicCMS version 4.0.20180210. An attacker can read arbitrary files with the help of admin/cmsWebFile/list.html?path=... / URL to read arbitrary files...

Denial of Service Vulnerability in Quick Easy FTP Server

Quick Easy FTP Server is a small FTP server. A denial of service attack vulnerability exists in Quick Easy FTP Server version V4.0.0, which can be exploited to cause the program to crash when no PASV command is entered...

Linux kernel denial of service vulnerability (CNVD-2018-12155)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the net/socket.c file in Linux kernel versions 4.17.1 and earlier. An attacker could exploit this vulnerability to cause a null...

Ximdex cross-site scripting vulnerability (CNVD-2018-14422)

Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition, etc. The DMS component is one of the data management components. A cross-site scripting vulnerability exists in the /edit URI of...

Trovebox Insecure Password Reset Token Generation Vulnerability

Trovebox is an open source image sharing and management platform. user is one of the user components. A security vulnerability exists in the user component of Trovebox prior to version 4.0.0-rc6, which stems from the program failing to create a secure password reset token. An attacker can exploit...

Appnitro MachForm File Upload Vulnerability

Appnitro MachForm is a tool for creating responsive forms in web pages. A security vulnerability exists in Appnitro MachForm versions prior to 4.2.3. An attacker can exploit this vulnerability to bypass the file upload filter...

Node.js Denial of Service Vulnerability (CNVD-2018-14713)

Joyent Node.js is the United States Joyent company's set of web applications built on top of the Google V8 JavaScript engine platform. The platform is primarily used for building highly scalable applications and writing code that can handle tens of thousands of simultaneous connections to a singl...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15873)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the setcompression method in Quest DR Series disk backup software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15875)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the registerDR2000v method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker can exploit this vulnerability to execute commands via the 'LicenseServer',...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15887)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Delete Duplicates" method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute system commands...

Quest DR Series Disk Backup Software Elevation of Privilege Vulnerability (CNVD-2018-15910)

The Quest DR Series are disk storage and deduplication appliances. An elevation of privilege vulnerability exists in versions of Quest DR Series disk backup software prior to 4.0.3.1. An attacker can exploit this vulnerability via a local script to elevate privileges from web server user to root...

CVE-2018-11190

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 2 of 6...

CVE-2018-11189

Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation issue 1 of 6...

CVE-2018-11183

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 41 of 46...

CVE-2018-11153

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 11 of 46...

CVE-2018-11154

Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection issue 12 of 46...

WUZHI CMS SQL Injection Vulnerability

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can use api/smscheck.php?param= URI to execute arbitrary SQL commands...

CScms Cross-Site Request Forgery Vulnerability

CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the plugins/sys/admin/Sys.php file in CScms version 4.1. A remote attacker can exploit this vulnerability to change the administrator name and password with the help of the...

K2 smartforms server-side request forgery vulnerability

K2 smartforms is the United States K2 company's a browser-based smart form adding tools. A server-side request forgery vulnerability exists in the runtime application in K2 smartforms version 4.6.11. An attacker can exploit this vulnerability by modifying the hostname in the...

Square Enix Final Fantasy XIV for Windows Man-in-the-Middle Attack Vulnerability

Square Enix Final Fantasy XIV for Windows is a Japanese role-playing game based on the Windwos platform by Square Enix. Square Enix's Final Fantasy XIV for Windows is a role-playing game based on the Windwos platform. A security vulnerability exists in the ffxivlauncher.exe file in versions 4.21...