HDCMS v2.0 suffers from SQL injection vulnerability (CNVD-2018-24676)

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. HDCMS v2.0 suffers from a SQL injection vulnerability, which can be exploited by remote attackers to obtain sensiti...

Directory Traversal Vulnerability in HDCMS v2.0

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. A directory traversal vulnerability exists in HDCMS v2.0. An attacker can exploit this vulnerability to obtain...

SUSE-SU-2018:3590-1 Security update for wireshark

This update for wireshark fixes the following issues: Wireshark was updated to 2.4.10 bsc1111647. Following security issues were fixed: - CVE-2018-18227: MS-WSP dissector crash wnpa-sec-2018-47 - CVE-2018-12086: OpcUA dissector crash wnpa-sec-2018-50 Further bug fixes and updated protocol support...

binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library

An integer wraparound has been discovered in the Binary File Descriptor BFD library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information...

Quick Count 'txtInstID' Parameter SQL Injection Vulnerability

Quickcount is a way to measure audience response on your own web host without having to prepare special slides or other settings. A SQL injection vulnerability exists in the 'txtInstID' parameter of Quick Count version 2.0, which can be exploited by an attacker to gain access to sensitive databas...

Joomla Component Responsive eXtro jQuery Gallery 'filter_category' parameter SQL injection vulnerability

eXtro Responsive Gallery creates fully responsive galleries based on images stored in the server catalog. The module also creates optimized preview images based on settings. A SQL injection vulnerability exists in the 'filtercategory' parameter in Joomla Component Responsive eXtro jQuery Gallery...

catfish blog cross-site request forgery vulnerability

Catfish blog is a set of open source blog system developed using the PHP language . A cross-site request forgery vulnerability exists in admin/Index/tiquan in Catfish blog version 2.0.33. A remote attacker can exploit this vulnerability to change the user type...

Open STA Manager Arbitrary File Download Vulnerability

Open STA Manager is a free, open source web performance testing tool. An arbitrary file download vulnerability exists in Open STA Manager version 2.3, which can be exploited by an attacker to download arbitrary files...

SV3C L-SERIES HD CAMERA Cross-Site Scripting Vulnerability

SV3C L-SERIES HD CAMERA is a webcam product from SV3C Technology, China. A cross-site scripting vulnerability exists in SV3C L-SERIES HD CAMERA version V2.3.4.2103-S50-NTD-B20170508B, which originates from the program failing to properly validate user-submitted input. The vulnerability can be...

TeaKKi Cross-Site Scripting Vulnerability

TeaKKi is a team document collaboration software. The software features document synchronization, category management and rights management. A cross-site scripting vulnerability exists in TeaKKi version 2.7. The vulnerability can be exploited by remote attackers to inject arbitrary web script or...

Hiroshi Yuki YukiWiki Denial of Service Vulnerability

Hiroshi Yuki YukiWiki is a Wiki engine. A security vulnerability exists in Hiroshi Yuki YukiWiki 2.1.3 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service significant consumption of CPU and memory resources...

Moxa ThingsPro Weak Encryption Vulnerability

Moxa ThingsPro is a suite of IoT gateway and device management solutions from Moxa. A security vulnerability exists in Moxa ThingsPro version 2.1 that stems from the program storing sensitive information in plaintext form. An attacker could exploit the vulnerability to recover access tokens...

Moxa ThingsPro Information Disclosure Vulnerability

Moxa ThingsPro is a suite of IoT gateway and device management solutions from Moxa. A security vulnerability exists in Moxa ThingsPro version 2.1. A remote attacker can exploit this vulnerability by performing a brute force attack to obtain the password of a valid user...

CVE-2018-18391

User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18395

Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18488

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...

Core: information disclosure due to authentication information exposed in a redirect

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0...

Cisco Firepower System Software Detection Engine Denial of Service Vulnerability

Cisco Firepower System Software is a next-generation firewall product NGFW from Cisco. A denial of service vulnerability exists in the implementation of the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocols in Cisco Firepower System Software, which stems from the program failing ...

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack...

CVE-2018-1749

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484...