Draytek Vigor3900, Vigor2960 and Vigor300B Buffer Overflow Vulnerability (CNVD-2020-29582)

DrayTek Vigor3900 and others are products of DrayTek Taiwan, China.DrayTek Vigor3900 is a broadband router/VPN gateway appliance.Vigor2960 is a load-balancing router and VPN gateway appliance.Vigor300B is a load-balancing router. A buffer overflow vulnerability exists in apmd in Draytek Vigor3900...

WordPress Kiboko Chained Quiz plugin SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the controllers/quizzes.php script in WordPress Kiboko Chained Quiz...

CVE-2020-7476

A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit Versions prior to 1.0.1, which could cause execution of malicious code when a malicious file is put in the search path...

GitLab Information Disclosure Vulnerability (CNVD-2020-19581)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions prior ...

CVE-2020-10222

npdf.dll in Nitro Pro before 13.13.2.242 is vulnerable to Heap Corruption at npdf!nitro::getproperty+2381 via a crafted PDF document...

Pricing Table by Supsystic Cross-Site Scripting Vulnerability

WordPress plugin Pricing Table by Supsystic is used to create pricing tables easily. A cross-site scripting vulnerability exists in Pricing Table by Supsystic versions prior to 1.8.2. No details of the vulnerability are provided at this time...

libyang buffer overflow vulnerability (CNVD-2020-10243)

libyang is a YANG data modeling language parser and toolkit written in C. It can be used as a toolkit for data modeling. A buffer overflow vulnerability exists in the 'resolvefeaturevalue' function in versions prior to libyang v1.0-r3. An attacker can exploit this vulnerability to cause the...

Lenovo XClarity Administrator Cross-Site Scripting Vulnerability (CNVD-2020-09985)

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product is capable of providing agentless hardware management for servers, storage, network switches, and more. A cross-site scripting vulnerability exists in Lenovo XClarity Administrator LXC...

DEBIAN-CVE-2020-6412

Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name...

DEBIAN-CVE-2020-6379

Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

UBUNTU-CVE-2020-6406

Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2020-8796

Biscom Secure File Transfer SFT before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server...

CVE-2020-1788

Honor V30 smartphones with versions earlier than 10.0.1.135C00E130R4P1 have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An attacker could trick the user into installing a malicious...

CVE-2019-14765

Incorrect Access Control in AfficheExplorateurParam in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers...

UBUNTU-CVE-2020-2674

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ...

CVE-2019-19548

Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user...

DOMPDF Remote Code Execution Vulnerability

DOMPDF is a converter to convert HTML to PDF. A remote code execution vulnerability exists in DOMPDF versions prior to 0.6.2. No details of the vulnerability are provided at this time...

DEBIAN-CVE-2019-5845

Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

php-shellcommand command injection vulnerability

php-shellcommand is a package for executing shell commands in PHP. An operating system command injection vulnerability exists in versions of php-shellcommand prior to 1.6.1. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc. from...

CVE-2019-0404

SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure...