IBM Security Identity Manager Virtual Appliance Information Disclosure Vulnerability (CNVD-2019-07175)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

CVE-2019-6707

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

CVE-2019-6259

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...

OpenSSH Access Restriction Bypass Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools for secure access to remote computers maintained by the OpenBSD Project Group. The tools are an open source implementation of the SSH protocol that supports encryption of all transmissions to effectively block eavesdropping, connection...

CVE-2019-5725

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

Vtiger CRM File Upload PHP Code Execution Vulnerability

Vtiger CRM is a customer relationship management software that helps businesses become organized, increase sales, improve marketing ROI and provide an enjoyable customer service experience. A file upload PHP code execution vulnerability exists in Vtiger CRM version 7.1.0 prior to Hotfix2. The...

CVE-2018-1926

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could explo...

OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JSSE. Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with...

SQL Injection Vulnerability in Qibo CMS V7.0 Background

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS V7.0 SQL injection vulnerability exists in the background. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL injection vulnerability in the background of Qibo CMS V7.0 system

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS system V7.0 backend SQL injection vulnerability exists. Attackers can use the vulnerability to obtain sensitive information...

Qibo CMS station system V7.0 backend file reading vulnerability

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS system V7.0 backend file reading vulnerability exists. The vulnerability is due to the failure of the user to submit a special string of processing , resulting in directory traversal , an attacker can use the vulnerabilit...

CVE-2018-1928

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119...

SonarSource SonarQube Information Disclosure Vulnerability

SonarSource SonarQube is an open source code quality management platform from SonarSource Switzerland. The platform can detect code quality from seven dimensions , as well as through the form of plug-ins to support a variety of programming languages , including java, C, C/C++ and other code quali...

CVE-2018-1584

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 143497...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-24264)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

PHP Denial of Service Vulnerability (CNVD-2019-00335)

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language is mainly used for Web development and supports a variety of databases and operating systems. A security vulnerability exists in th...

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite and SIMATIC IT UA Discrete Manufacturing License Issue Vulnerabilities

Siemens SIMATIC IT LMS, SIMATIC IT Production Suite, and SIMATIC IT UA Discrete Manufacturing are products of Siemens, Germany.Siemens SIMATIC IT LMS is a line monitoring system for overall equipment effectiveness OEE. Siemens SIMATIC IT LMS is a line monitoring system for Overall Equipment...

CVE-2018-18775

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product...

CVE-2018-18777

Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" in the parameter subpage allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application...

CVE-2018-18776

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the admin/admin.asp ShowAll parameter. NOTE: this is a deprecated product...