CVE-2018-1000083

Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the...

CVE-2018-1000081

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...

PYSEC-2018-110

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...

PYSEC-2018-111

Ajenti version version 2 contains a Cross ite Request Forgery CSRF vulnerability in the command execution panel of the tool used to manage the server. that can result in Code execution on the server . This attack appear to be exploitable via Being a CSRF, victim interaction is needed, when the...

PYSEC-2018-109

Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal user. This attack appear to be exploitable via By knowing how the requisition is made, and sending it as a normal user, the server, in...

CVE-2018-1000082

Ajenti version version 2 contains a Cross ite Request Forgery CSRF vulnerability in the command execution panel of the tool used to manage the server. that can result in Code execution on the server . This attack appear to be exploitable via Being a CSRF, victim interaction is needed, when the...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2018-06468)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...

Exempi 'PSD_MetaHandler::CacheFileData()' function heap buffer overflow vulnerability

Exempi is an open source implementation of XMP based on the Adobe XMP SDK. A heap buffer overflow vulnerability exists in the 'PSDMetaHandler::CacheFileData' function in Exempi 2.4.4 and earlier versions, which stems from a failure of the program in the...

Juniper AppFormix Elevation of Privilege Vulnerability

Juniper AppFormix is a Juniper Networks optimization and management software platform for public, private and hybrid clouds. A security vulnerability exists in Juniper AppFormix version 2.7, version 2.11 prior to 2.11.3, and version 2.15 prior to 2.15.2. An attacker could exploit the vulnerabilit...

Exempi 'PostScript_MetaHandler::ParsePSFile()' function heap buffer overflow vulnerability

Exempi is an open source implementation of XMP based on the Adobe XMP SDK. A heap buffer overflow vulnerability exists in the 'PostScriptMetaHandler::ParsePSFile' function in the XMPFiles/source/FileHandlers/PostScriptHandler.cpp file in Exempi 2.4.4 and earlier. An attacker can exploit this...

Cimg heap buffer out-of-bounds read vulnerability (CNVD-2018-05447)

CImg is an open source C++ tool library for image processing . A heap buffer out-of-bounds read vulnerability exists in the 'loadbmp' function of the CImg.h file in CImg version 220. The vendor has released a security advisory and related patch information to fix this vulnerability, and users are...

Cimg heap buffer out-of-bounds read vulnerability (CNVD-2018-05448)

CImg is an open source C++ tool library for image processing . A heap buffer out-of-bounds read vulnerability exists in the 'loadbmp' function of the CImg.h file in CImg version 220. No detailed vulnerability details are provided at this time...

Code execution vulnerability in LaySNS v2.2.0 System.php page

LaySNS Light Community is a comprehensive website system based on ThinkPHP5+LayUI that integrates content publishing and community exchange. A code execution vulnerability exists in the program implementation of the LaySNS v2.2.0 System.php page, which is due to the system's failure to strictly...

Cimg Double Release Vulnerability

CImg is an open source C++ tool library for image processing . A double release vulnerability exists in the loadbmp file of the CImg.h file in CImg version 220. No details of the vulnerability are provided at this time...

YIXUNCMS v2.0.4.91 has an arbitrary file write vulnerability

YIXUNCMS is a convenient CMS management system developed by Yixun BS Software Studio specializing in website construction for small and medium-sized enterprises. YIXUNCMS v2.0.4.91 suffers from an arbitrary file write vulnerability, which is caused by the system failing to strictly filter...

Xen Denial of Service Vulnerability (CNVD-2018-04654)

Xen is an open source virtual machine monitor developed by the Xen Project. A denial of service vulnerability exists in 4.10.x and earlier versions of Xen. A guest operating system user can exploit this vulnerability to cause a denial of service hypervisor crash or gain privileges by triggering a...

SQL injection vulnerability in IndexController.php page of iZhanCMS v2.1 version

Love Station CMS is an open source and free CMS content management system. The iZhanCMS v2.1 IndexController.php page suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

MP4v2 Denial of Service Vulnerability

MP4v2 is an open source library written in C++ for handling MP4 containers. A security vulnerability exists in the MP4Atom class of the mp4atom.cpp file in MP4v2 2.0.0 and earlier versions, which stems from the program's failure to properly handle Entry Number validation. A remote attacker can...

Aisook building system v2.1 exists arbitrary file writing vulnerability

Aisook building system is a php + mysql development, based on CodeIgniter main enterprise building system. Aisook building system v2.1 there are arbitrary file writing vulnerability, the vulnerability is due to the system on the file path and write the file content failed to effectively filter. T...

eQ-3 AG HomeMatic CCU2 Open XML-RPC Port Vulnerability

The eQ-3 AG Homematic CCU2 is a central control unit for controlling smart home devices from eQ-3 Germany. A security vulnerability exists in the eQ-3 AG HomeMatic CCU2 version 2.29.22. An attacker can exploit the vulnerability by sending arbitrary XML-RPC requests to control attached BidCos...