475 matches found
Remote Code Execution Vulnerability in LaySNS
LaySNS is a lightweight, integrated content management and community interaction website management system based on ThinkPHP+Layui architecture. LaySNS suffers from a remote code execution vulnerability. An attacker can exploit the vulnerability to execute commands and gain server privileges...
DLL Hijacking Vulnerability in Weinview EasyBuilder Pro
EasyBuilder Pro is a screen editing software from Valiant Technology. A DLL hijacking vulnerability exists in Weinview EasyBuilder Pro, which can be exploited by attackers to execute malicious code...
TYPO3 cross-site scripting vulnerability (CNVD-2019-41232)
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3 versions prior to 4.3.12, 4.4.x prior to 4.4.9 and 4.5.x prior to 4.5.4. The vulnerability stems from a lack of proper validation of...
Xionghai CMS V1.0 has a file inclusion vulnerability
XIONGHAI CMS is developed by XIONGHAI can be widely used in personal blogs, personal websites, corporate websites, a set of integrated website management system. XIONGHAI CMS V1.0 has a file inclusion vulnerability that can be exploited by attackers to include arbitrary files...
CVE-2019-1116
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1099, CVE-2019-1100, CVE-2019-110...
Microsoft DirectWrite / AFDKO - Stack Corruption in OpenType Font Handling Due to Negative nAxes
-----===== Background =====----- AFDKO Adobe Font Development Kit for OpenType is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library written in C, which provides interfaces for reading and writing Type 1, OpenType, TrueType to some...
SandboxEscaper Debuts ByeBear Windows Patch Bypass
Guerrilla developer SandboxEscaper has disclosed a second bypass exploit for a patch that fixes a Windows local privilege-escalation LPE flaw — again without notifying Microsoft. The exploit, dubbed “ByeBear,” enables attackers to get past the patch to attack a permissions-overwrite,...
PT-2024-6534 · Php +10 · Php +10
Name of the Vulnerable Software and Affected Versions: PHP versions 8.1. through 8.1.29 PHP versions 8.2. through 8.2.23 PHP versions 8.3. through 8.3.11 Description: The issue is related to erroneous parsing of multipart form data contained in an HTTP POST request, which could lead to legitimate...
PT-2019-2950 · Qos.Ch +7 · Logback-Core +7
Name of the Vulnerable Software and Affected Versions: FasterXML jackson-databind versions 2.x through 2.9.9 Description: The issue is related to the failure to block the logback-core class from polymorphic deserialization, which can lead to various impacts, including remote code execution,...
Microsoft Office Access Connectivity Engine Input Validation Error Vulnerability (CNVD-2019-27312)
Microsoft Office is a U.S. Microsoft Microsoft company's office software suite of products. Common components of the product include Word, Excel, Access, Powerpoint, FrontPage, etc. Office Access Connectivity Engine is one of the database connection engine. A remote code execution vulnerability...
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2019-2526
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are prior to 5.2.24 and prior to 6.0.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualB...
Unspecified Vulnerability in Oracle MySQL Server (CNVD-2019-26709)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: DDL subcomponent of the MySQL Server component in Oracle MySQL, version 8.0.13 and earlier. An attacke...
Oracle MySQL Server Denial of Service Vulnerability (CNVD-2018-21803)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: Parser subcomponent of the MySQL Server component of Oracle MySQL, version 8.0.12 and earlier. An...
Microsoft PowerPoint Remote Code Execution Vulnerability (CNVD-2018-17618)
Microsoft Office PowerPoint is Microsoft's presentation software. A remote code execution vulnerability exists in Microsoft PowerPoint. The vulnerability stems from the software failing to properly handle objects in memory. An attacker can exploit the vulnerability to run arbitrary code in the...
PT-2018-3597 · Mysql Server +8 · Mysql Client +8
Name of the Vulnerable Software and Affected Versions: MySQL Client versions 5.7.32 and prior MySQL Client versions 8.0.22 and prior Description: The issue is related to the C API component of the MySQL Client product, which allows an unauthenticated attacker with network access via multiple...
Android Security Bulletin—June 2018Stay organized with collectionsSave and categorize content based on your preferences.
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2018-06-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...
Google Android Framework elevation of privilege vulnerability (CNVD-2018-10696)
Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Framework of Google Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, which can be exploited by an attacker to elevate privileges...