Results
2,593 of 17,305· Page 17/52Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it do
In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username param
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd,
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikar
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikar
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be inje
A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https reque
A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacke
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long p
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mai
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id param
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability.
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The serv
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protec
Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary op
Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ direct
Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote at
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote att
A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to val
An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been di
The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/c
The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via th
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd,
An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invali
An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_
An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy
An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and writ
In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server use
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbi
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.ll
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbit
A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 de
Test your stack for 2019issues
CyberStrike tests your own apps and APIs, then verifies each finding before you see it.