SQL Injection Vulnerability in nucms v2.2

nucms is a content management system based on PHP+MYSQL technology developed by Liaocheng Leadsun Network Technology Co. nucms v2.2 has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

CloudBees Jenkins TraceTronic ECU-TEST Plugin Server-Side Request Forgery Vulnerability

CloudBees Jenkins is a suite of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor ongoing software releases/testing projects and some timed tasks.TraceTronic ECU-TEST Plugin is an automated test software for embedded systems that uses... TraceTronic ECU-TEST...

AuraCMS Cross-Site Scripting Vulnerability

AuraCMS is a content management system based on PHP and MySQL. The system is characterized by simplicity and modularity. A cross-site scripting vulnerability exists in AuraCMS version 2.3. A remote attacker can inject arbitrary web scripts by adding a Guestbook to exploit the vulnerability...

rejucms cross-site scripting vulnerability

rejucms is an online video web content management system CMS. A cross-site scripting vulnerability exists in rejucms version 2.1. A remote attacker can inject arbitrary web script or HTML by sending the 'content' parameter to the admin/book.php URL...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2018-18106)

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. An information disclosure vulnerability exists in IBM Sterlin...

PT-2018-12812 · My Little Forum · My Little Forum

Name of the Vulnerable Software and Affected Versions: my little forum version 2.4.12 Description: The issue allows for XSS via the Menu Link field in the Add page option. Recommendations: For my little forum version 2.4.12, consider restricting access to the Add page option until a fix is...

CVE-2018-14838

rejucms 2.1 has stored XSS via the admin/book.php content parameter...

SQL Injection Vulnerabilities in Laoban CMS v2.0

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. SQL injection vulnerability exists in several pages of Laoban CMS v2.0. An attacker can exploit the vulnerability to execute arbitrar...

CVE-2018-0618

Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-10608

SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required...

PT-2018-12476 · Mp4V2 · Mp4V2

Name of the Vulnerable Software and Affected Versions: MP4v2 version 2.0.0 Description: The issue arises from a type confusion in the MP4Atom::factory function within mp4atom.cpp, where MP4ItemAtom is used instead of the required MP4DataAtom. This confusion occurs when handling a crafted MP4 file...

Dicoogle PACS File Inclusion Vulnerability

Dicoogle is an open source medical image repository with a scalable indexing system and distributed mechanism. A file inclusion vulnerability exists in Dicoogle PACS version 2.5.0 that allows an attacker to read arbitrary files accessible to web users...

SQL Injection Vulnerability in SEMCMS_In***.php Page of SemCms Building System Version 2.7

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox , google, 360 and other mainstream browsers.SemCms php version written in php language, combined with apache, in window, or linux system to run...

CVE-2018-8306

A command injection vulnerability exists in the Microsoft Wireless Display Adapter MWDA when the Microsoft Wireless Display Adapter does not properly manage user input, aka "Microsoft Wireless Display Adapter Command Injection Vulnerability." This affects Microsoft Wireless Display Adapter V2...

SemCms website builder 2.7 version exists arbitrary file deletion vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox , google, 360 and other mainstream browsers.SemCms php version written in php language, combined with apache, in window, or linux system to run...

Code Execution Vulnerability in LeShang Mall System v2.2.0

LeShang mall system is a based on THINKPHP5.0 as the core development of a free open source professional mall system. Code execution vulnerability exists in LeShang Mall System v2.2.0. An attacker can exploit the vulnerability to write arbitrary files and gain server privileges...

Dell EMC iDRAC6 Monolithic and Modular Command Injection Vulnerabilities

Dell EMC iDRAC6 Monolithic and Modular are both system management solutions containing hardware and software from Dell USA. The solutions provide remote management, crash system recovery and power control for Dell PowerEdge systems. A command injection vulnerability exists in the web-based...

GNU Binutils Denial of Service Vulnerability (CNVD-2018-13846 )

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utilities developed by the GNU Project to work with object files in a variety of formats, with connectors, assemblers, and other tools for object files and archives.The Binary File Descriptor BFD library a.k.a...

SUSE-SU-2018:1850-1 Security update for python-paramiko

This update for python-paramiko to version 2.0.8 fixes the following issues: - CVE-2018-7750: transport.py in the SSH server implementation of Paramiko did not properly check whether authentication is completed processing other requests. A customized SSH client could have skipped the authenticati...

OpenSLP Double Release Vulnerability

OpenSLP Service Location Protocol is an IETF standard protocol developed by the OpenSLP project for dynamic service discovery within the Internet. The protocol supports looking up services in the network by their types and attributes. A double release vulnerability exists in the slpdprocess.c fil...