4033 matches found
Code injection
A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller APIC Software could allow an unauthenticated, remote attacker to access sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms for certa...
Arbitrary File Deletion Vulnerability in NiuShop B2B2C Multi-Merchant Mall System Up***.php File
NiuShop B2B2C Multi-Merchant Mall System is a PHP open source e-commerce system designed and developed completely independently by Shanxi NiuKu Information Technology Co. NiuShop B2B2C Multi-merchant Mall System Up.php file exists arbitrary file deletion vulnerability. Attackers can construct...
CVE-2019-11612
doorGets 7.0 has an arbitrary file deletion vulnerability in /fileman/php/deletefile.php. A remote unauthenticated attacker can exploit this vulnerability to delete arbitrary files...
CVE-2019-11611
doorGets 7.0 has a sensitive information disclosure vulnerability in /fileman/php/download.php. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...
Cybozu Garoon Cross-Site Scripting Vulnerability (CNVD-2019-12704)
Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon versions 4.6.0 through 4.6.3, which originates from ...
JioFi 4G M2S 1.0.2 - mask Cross-Site Scripting Vulnerability
Exploit for hardware platform in category web applications Exploit Title: cgi-bin/qcmapwebcgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter. Exploit Author: Vikas Chaudhary Vendor Homepage: https://www.jio.com/ Hardware Link:...
CVE-2018-2880
Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. The supported version that is affected is 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successful attacks...
CVE-2019-11376
SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a ?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own...
CloudBees Jenkins Gearman plugin cross-site request forgery vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Gearman Plugin is used in one of the highly...
CloudBees Jenkins Chef Sinatra Plugin Cross-Site Request Forgery Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks.Chef Sinatra Plugin is used in one of the plugin in...
IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability (CNVD-2019-09070)
IBM Rational DOORS Next Generation DNG/RRC is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM, USA. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers and project...
CVE-2019-10276
Western Bridge Cobub Razor 0.8.0 has a file upload vulnerability via the web/assets/swf/uploadify.php URI, as demonstrated by a .php file with the image/jpeg content type...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2019-12161)
CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMSMS versi...
CVE-2018-19917
Microweber 1.0.8 has reflected cross-site scripting XSS vulnerabilities...
Code Execution Vulnerability in EmpireCMS
EmpireCMS is based on B/S structure, secure, stable and flexible website management system. EmpireCMS there are code execution vulnerabilities , attackers can exploit the vulnerability of remote code execution , access to server privileges...
UCMS Cross-Site Scripting Request Vulnerability
UCMS is a simple open source content management system, it can be very easy to quickly develop various kinds of enterprise station, article station and station system. The system is compatible with PHP5.2-PHP7.0, and it can be used on APACHE, NGINX, IIS, and supports two databases of MySQL SQLite...
Google Chrome CSP Bypass Vulnerability (CNVD-2019-23133)
Chrome is a web browsing tool developed by Google. A blob URL CSP bypass vulnerability exists in Google Chrome versions prior to 73.0.3683.75. An attacker can exploit this vulnerability to bypass content security policy via a crafted HTML page...
JTBC Cross-Site Request Forgery Vulnerability
JTBC PHP is a PHP-based open source content management system CMS. A cross-site request forgery vulnerability exists in the /console/account/manage.php?type=action&action=add URL in JTBC v3.0C. A remote attacker can exploit this vulnerability to add an administrator account...
PHPMyWind Cross-Site Scripting Vulnerability
PHPMyWind is a PHP + MySQL based development , W3C standard building engine . A cross-site scripting vulnerability exists in PHPMyWind. The vulnerability is due to the username parameter of /install/index.php in PHPMyWind 5.5 fails to effectively filter user-submitted data, which can be exploited...