Vanilla Remote Code Execution Vulnerability (CNVD-2019-06793)

Vanilla is an open source multi-language, fully extensible forum program. A security vulnerability exists in Vanilla versions prior to 2.5.5 and 2.6.x prior to 2.6.2. A remote attacker can exploit this vulnerability to execute code by calling the 'unserialize' function...

Miss Marple Enterprise Edition Code Execution Vulnerability

Miss Marple Enterprise Edition is a suite of enterprise IT asset and license management programs. A security vulnerability in Miss Marple Enterprise Edition prior to version 2.0 exists because the program fails to detect updates. An attacker could exploit the vulnerability to execute arbitrary co...

CVE-2018-18861

Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command...

CVE-2018-9073

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite and SIMATIC IT UA Discrete Manufacturing License Issue Vulnerabilities

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite, and SIMATIC IT UA Discrete Manufacturing are products of Siemens, Germany.Siemens SIMATIC IT LMS is a line monitoring system for overall equipment effectiveness OEE. Siemens SIMATIC IT LMS is a line monitoring system for Overall Equipment...

Netwide Assembler Null Pointer Dereference Vulnerability (CNVD-2019-05119)

Netwide Assembler NASM is a Linux-based assembler that creates binaries and writes bootloaders. A null pointer dereference vulnerability exists in the 'findlabel' function of the asm/labels.c file in NASM version 2.14rc15, which can be exploited by an attacker to cause a denial of service null...

Netwide Assembler Memory Disclosure Vulnerability

Netwide Assembler NASM is a Linux-based assembler that creates binaries and writes bootloaders. A memory leak vulnerability exists in NASM 2.14rc16 and earlier versions, which can be exploited by an attacker to cause a denial of service memory leak...

ZyXEL ZyWALL USG Cross-Site Request Forgery Vulnerability

ZyXEL ZyWALL USG is a network security firewall appliance from Hopkins ZyXEL Technology. A cross-site request forgery vulnerability exists in ZyXEL ZyWALL USG version 2.12 AQQ.2 and 3.30 AQQ.7. A remote attacker can exploit this vulnerability by adding user accounts with the help of the 'cmd'...

LAOBANCMS Information Disclosure Vulnerability

Laoban CMS LAOBANCMS content management system is based on PHP + MYSQL environment developed by the old class of open-source website building system . LAOBANCMS 2.0 suffers from an information disclosure vulnerability. A remote attacker can exploit this vulnerability by directly requesting the...

SQL Injection Vulnerability in HDCMS v2.0 groupLists Function

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. HDCMS v2.0 version groupLists function has a SQL injection vulnerability, remote attackers can use this vulnerabili...

DEBIAN-CVE-2018-16843

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngxhttpv2module not compiled by default if the 'http2' option of the 'listen' directive is used in a configuratio...

HDCMS v2.0 suffers from SQL injection vulnerability (CNVD-2018-24676)

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. HDCMS v2.0 suffers from a SQL injection vulnerability, which can be exploited by remote attackers to obtain sensiti...

Directory Traversal Vulnerability in HDCMS v2.0

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. A directory traversal vulnerability exists in HDCMS v2.0. An attacker can exploit this vulnerability to obtain...

SUSE-SU-2018:3590-1 Security update for wireshark

This update for wireshark fixes the following issues: Wireshark was updated to 2.4.10 bsc1111647. Following security issues were fixed: - CVE-2018-18227: MS-WSP dissector crash wnpa-sec-2018-47 - CVE-2018-12086: OpcUA dissector crash wnpa-sec-2018-50 Further bug fixes and updated protocol support...

binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library

An integer wraparound has been discovered in the Binary File Descriptor BFD library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information...

Quick Count 'txtInstID' Parameter SQL Injection Vulnerability

Quickcount is a way to measure audience response on your own web host without having to prepare special slides or other settings. A SQL injection vulnerability exists in the 'txtInstID' parameter of Quick Count version 2.0, which can be exploited by an attacker to gain access to sensitive databas...

Joomla Component Responsive eXtro jQuery Gallery 'filter_category' parameter SQL injection vulnerability

eXtro Responsive Gallery creates fully responsive galleries based on images stored in the server catalog. The module also creates optimized preview images based on settings. A SQL injection vulnerability exists in the 'filtercategory' parameter in Joomla Component Responsive eXtro jQuery Gallery...

catfish blog cross-site request forgery vulnerability

Catfish blog is a set of open source blog system developed using the PHP language . A cross-site request forgery vulnerability exists in admin/Index/tiquan in Catfish blog version 2.0.33. A remote attacker can exploit this vulnerability to change the user type...

Open STA Manager Arbitrary File Download Vulnerability

Open STA Manager is a free, open source web performance testing tool. An arbitrary file download vulnerability exists in Open STA Manager version 2.3, which can be exploited by an attacker to download arbitrary files...

TeaKKi Cross-Site Scripting Vulnerability

TeaKKi is a team document collaboration software. The software features document synchronization, category management and rights management. A cross-site scripting vulnerability exists in TeaKKi version 2.7. The vulnerability can be exploited by remote attackers to inject arbitrary web script or...