4285 matches found
CVE-2020-12058
CVE-2020-12058 affects osCommerce CE Phoenix prior to 1.0.6.0, where multiple XSS flaws allow injection/execution of arbitrary JavaScript. Vulnerable components include admin scripts such as order_status.php, tax_rates.php, languages.php, countries.php, tax_classes.php, reviews.php, zones.php, an...
PT-2020-13020
Name of the Vulnerable Software and Affected Versions osCommerce CE Phoenix versions prior to 1.0.6.0 Description The issue allows an attacker to inject and execute arbitrary JavaScript code. This can be achieved by injecting malicious code into specific parameters, including the page parameter t...
CVE-2020-12058: Improper Neutralization of Input During Web Page Generation
Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...
Denial of Service Vulnerability in EKI-1511X-AE/ADAM-4571-CE at Advantech (China) Co.
Advantech China Co., Ltd. is a global manufacturer in the intelligent system industry. A denial of service vulnerability exists in Advantech China Co. EKI-1511X-AE/ADAM-4571-CE, which can be exploited by attackers to cause a program crash...
ce-marking.help Cross Site Scripting vulnerability OBB-1236829
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Security Bulletin: WML CE: TensorFlow: In SQLite before 3.32.3, select.c mishandles query-flattener optimization
Summary In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. TensorFlow in WML CE uses SQLite as its embedded SQL database engine. Vulnerability Details CVEID:...
CVE-2020-15052
An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields...
CVE-2020-15053
An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects...
CVE-2020-15052
An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields...
CVE-2020-15053
An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects...
CVE-2020-15052
An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields...
CVE-2020-15053
Artica Proxy CE (before 4.28.030.418) contains a Reflected XSS in multiple search fields (real time request, System Events, Proxy Events, Proxy Objects, Firewall objects). The issue is documented across CVE-2020-15053 entries (NVD, Red Hat, CNVD, etc.). What is affected: Artica Proxy CE
CVE-2020-15053
An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects...
CVE-2020-15052
CVE-2020-15052 affects Artica Proxy CE before 4.28.030.418. The vulnerability is a SQL injection via the Netmask, Hostname, and Alias fields, stemming from insufficient validation of externally entered SQL statements in the database-backed Artica Proxy Community Edition. Connected CNVD-2020-41859...
CVE-2020-15052: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields...
PT-2020-14147
Name of the Vulnerable Software and Affected Versions Artica Proxy CE versions prior to 4.28.030.418 Description An issue exists where SQL Injection is possible via the Netmask, Hostname, and Alias fields. Recommendations For versions prior to 4.28.030.418, update to version 4.28.030.418 or later...
PT-2020-14148
Name of the Vulnerable Software and Affected Versions Artica Proxy CE versions prior to 4.28.030.418 Description A reflected XSS issue exists in the search fields for real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects. Recommendations For versions prior to...
CVE-2020-15053: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects...
Security Bulletin: WML CE: Pillow before 7.1.0 has multiple out-of-bounds reads
Summary Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. PyTorch and TensorFlow use Pillow. Vulnerability Details CVEID: CVE-2020-10177 DESCRIPTION: Pillow could allow a remote attacker to obtain sensitive information, caused by multiple out-of-bounds reads in...
Security Bulletin: WML CE: In Pillow before 7.1.0, there is a Buffer Overflow
Summary In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c. PyTorch and TensorFlow uses Pillow. Vulnerability Details CVEID: CVE-2020-10378 DESCRIPTION: Pillow could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read when readin...