libjpeg-turbo Buffer Overflow Vulnerability

libjpeg is a C language library for processing image data in JPEG format. The product includes JPEG decoding, JPEG encoding and other JPEG functions. libjpeg-turbo is an optimized and improved version of libjpeg. A buffer overflow vulnerability exists in the 'getrgbrow' function of the rdppm.c fi...

Google Android System Information Disclosure Vulnerability (CNVD-2020-31522)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An information disclosure vulnerability exists in the System component of Google Android 10. An attacker can exploit the vulnerability to obtain sensitive informati...

Centreon host-monitoring widget, service-monitoring widget and tactical-overview widget cross-site scripting vulnerabilities (CNVD-2021-28002)

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon. The product mainly provides monitoring of network , system and application resources . host-monitoring widget is one of the host monitoring widget . service-monitoring widget is one of the...

SAP Master Data Governance SQL Injection Vulnerability

SAP Master Data Governance is a suite of data management tools from SAP Germany for maintaining, validating, and distributing master data. A SQL injection vulnerability exists in SAP Master Data Governance. An attacker could exploit this vulnerability by executing specially crafted database query...

WeiPHP suffers from an information leakage vulnerability

WeiPHP is an open source WeChat public platform development framework to build a personal WeChat public account operation platform. WeiPHP suffers from an information disclosure vulnerability. An attacker can exploit this vulnerability to obtain sensitive information...

Primeo has a flawed logic vulnerability

Primeo PEO is an ethereum-based digital currency.A security vulnerability exists in the 'doAirdrop' function in the smart contract implementation of Primeo PEO. An attacker could exploit the vulnerability to issue any number of virtual currencies...

Ethereum Lottery has a flawed logic vulnerability

Ethereum Lottery is an ethereum-based betting game.Ethereum Lottery's simplelottery smart contract implementation has a security vulnerability in the 'PayWinner' function that stems from the ' PayWinner' function uses the publicly readable variable maxTickets to generate random values. The...

The vulnerability of Xen hypervisors relates to the lack of a mechanism for checking input data, allowing attackers to trigger a service failure.

The vulnerability of Xen hypervisors is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows an attacker to cause service failures...

McAfee Endpoint Security Authorization Issues Vulnerability

McAfee Endpoint Security ENS is the United States McAfee McAfee company's set of framework for providing intelligent collaboration and advanced threat defense. The framework supports the entire threat defense lifecycle of real-time communications control and actionable threat forensics and so on...

Authentication Bypass Vulnerability in Multiple NETGEAR Products

NETGEAR D6200 and others are products of NETGEAR Corporation.NETGEAR D6200 is a wireless modem.NETGEAR JR6150 is a wireless router.NETGEAR PR2000 is a wireless router.NETGEAR JR6150 is a wireless router.NETGEAR JR6150 is a wireless router.NETGEAR JR6150 is a wireless router.NETGEAR JR6150 is a...

Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two

One of the critical strategic and tactical roles that cyber threat intelligence CTI plays is in the tracking, analysis, and prioritization of software vulnerabilities that could potentially put an organization’s data, employees and customers at risk. In this four-part blog series, FireEye Mandian...

CVE-2020-6427

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the win32k component in Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the win32k component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

CVE-2013-3551

Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System OTRS 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent...

GHSA-P9CM-R7JG-8Q3G Incorrect signature verification in SimpleSAMLphp

Background An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. Description The SimpleSAMLXMLValidator class allows the verification of the XML digital signature of a SAML 1...

The vulnerability of FreeBSD operating systems, related to deficiencies in access control, allows attackers to escalate their privileges.

The vulnerability of FreeBSD operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Memory Corruption Vulnerability in iPubsoft PDF Splitter

iPubsoft PDF Splitter is a PDF processing tool. A memory corruption vulnerability exists in iPubsoft PDF Splitter, which can be exploited by attackers to cause the program to crash by constructing malformed PDF files...

Eclipse Jetty Cross-Site Scripting Vulnerability (CNVD-2021-28275)

Jetty is a pure Java-based web server and Java Servlet container . A cross-site scripting vulnerability exists in Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118. The vulnerability stems from an exception message in stacktraces contained in the generated unescaped...

CVE-2019-5860

Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file...

Micro Focus Operations Agent XXE Vulnerability

Micro Focus Operations Agent helps you monitor your system by collecting metrics that indicate the operational status, performance, resource utilization, and availability of essential elements of your system. A XXE vulnerability exists in Micro Focus Operations Agent, which can be exploited by...