353 matches found
CVE-2017-11582
dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php...
FineCms SQL Injection Vulnerability (CNVD-2017-18532)
FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A SQL injection vulnerability exists in FineCms version 5.0.9. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...
CVE-2016-9156
A vulnerability in Siemens SICAM PAS all versions before V8.09 could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP...
PT-2016-2996 · Siemens · Siemens Sicam Pas
Name of the Vulnerable Software and Affected Versions: Siemens SICAM PAS versions prior to V8.09 Description: The issue is related to inadequate access control, allowing a remote attacker to upload, download, or delete files in certain parts of the file system. This can be achieved by sending...
PT-2016-4587 · Openssl · Rust-Openssl
Name of the Vulnerable Software and Affected Versions: rust-openssl versions prior to 0.9.0 Description: The issue is related to SSL/TLS man-in-the-middle attacks due to insecure defaults in the openssl crate for Rust. Specifically, certificate verification is off by default, and there is no API...
EMC RSA BSAFE Micro Edition Suite TLS Man-in-the-Middle Attack Vulnerability
EMC RSA BSAFE Micro Edition Suite MES is an encryption toolkit from EMC Corporation. The toolkit helps developers achieve stable and secure application design.TLS Transport Layer Security is a set of protocols used to provide confidentiality and data integrity between two communicating...
The vulnerability of the iOS operating system and the Safari browser allows a hacker to inject arbitrary Web or HTML code.
The vulnerability of the WebKit JavaScript component of the iOS operating system and the Safari browser exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially...
LOCKON EC-CUBE Cross-Site Request Forgery Vulnerability (CNVD-2016-02684)
LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. A cross-site request forgery vulnerability exists in LOCKON EC-CUBE versions 3.0.0 through 3.0.9. An attacker can...
LOCKON EC-CUBE Access Privilege Vulnerability (CNVD-2016-02686)
LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. The platform supports product login, user evaluation, artwork layout and so on. An access privilege vulnerability exists in LOCKON EC-CUBE versions 3.0.0 through 3.0.9. A remote attacker can exploi...
UBUNTU-CVE-2016-4052
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes ESI responses...
Casebook plugin cross-site scripting vulnerability
Casebook plugin for baserCMS is a casebook plugin for baserCMS. A cross-site scripting vulnerability exists in Casebook plugin for baserCMS versions prior to 0.9.4, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
The vulnerability of the microprogramming software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems allows a intruder to authenticate as an arbitrary user.
The vulnerability of the Microprogramming Software in Janitza UMG 508, 509, 511, 604, 605 power supply monitoring systems is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to bypass authentication by acting as an arbitrary user...
X2Engine X2CRM Cross-Site Scripting Vulnerability
X2Engine X2CRM is the United States X2Engine company's set of open source customer relationship management program CRM. A cross-site scripting vulnerability exists in X2Engine X2CRM versions prior to 5.0.9. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML...
The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the net-snmp-devel-5.0.9 package for the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...
PYSEC-2015-34
The buildindexfromtree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree...
BELL-CVE-2014-8709 CVE-2014-8709 does not affect BellSoft software
Bulletin has no description...
httpd: http 0.9 request bypass of the reverse proxy vulnerability CVE-2011-3368 fix
The modproxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to...
PT-2011-1125 · Red Hat · Libvirt-Devel +5
Name of the Vulnerable Software and Affected Versions: libvirt versions prior to 0.9.0 libvirt-debuginfo versions 0.8.1 libvirt-devel versions 0.8.1 libvirt-python versions 0.8.1 libvirt-client versions 0.8.1 Description: The issue affects the libvirt package in Red Hat Enterprise Linux,...
security flaw
Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code while Ethereal is parsing keysyms...
