3056 matches found
CVE-2021-27330
Triconsole Datepicker Calendar 3.77 is affected by cross-site scripting XSS in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents...
Cross site scripting
Triconsole Datepicker Calendar 3.77 is affected by cross-site scripting XSS in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents...
CVE-2021-27374
VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve "Zugriff auf Inhalte der WebOffice Applikation."...
das Klimabündnis VertiGIS WebOffice Access Control Error Vulnerability
das Klimabündnis VertiGIS WebOffice is an application from das Klimabündnis, Germany. It provides for the creation of maps and plans that can be accessed online. An Access Control Error vulnerability exists in VertiGIS WebOffice that allows an attacker to access the contents of the WebOffice...
The vulnerability of the Windows operating system’s registry editor allows a hacker to replace the contents of the dialog box.
The vulnerability of the Windows operating system’s registry editor is related to errors in checking input data when modifying the registry. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by having the user open a specially crafted .reg file. During this process,...
The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.
The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in the “File Contents...
CVE-2020-8568
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...
CVE-2020-3691
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...
Integer overflow
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...
VulnCheck KEV: CVE-2018-8595
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows...
CVE-2021-0220
The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser for example via XSS or access cached contents may be able to obtain a copy of...
CVE-2021-0220 Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI
The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser for example via XSS or access cached contents may be able to obtain a copy of...
EulerOS Virtualization for ARM 64 3.0.2.0 : xorg-x11-server (EulerOS-SA-2021-1048)
According to the versions of the xorg-x11-server packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames functi...
Updated spice-vdagent package fixes security vulnerabilities
Matthias Gerstner discovered that SPICE vdagent incorrectly handled the activexfers hash table. A local attacker could possibly use this issue to cause SPICE vdagent to consume memory, resulting in a denial of service CVE-2020-25650. Matthias Gerstner discovered that SPICE vdagent incorrectly...
Important: xorg-x11-server
Issue Overview: A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-14345 A flaw was found i...
Cross-site Scripting (XSS)
Overview markdown-it-toc is an Adds syntax for an automatically generated table of contents to markdown-it markdown parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The title of the generated toc and the contents of the header are not escaped. PoC // XSS from...
Ubuntu 18.04 LTS / 20.04 LTS : SPICE vdagent vulnerabilities (USN-4617-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4617-1 advisory. Matthias Gerstner discovered that SPICE vdagent incorrectly handled the activexfers hash table. A local attacker could possibly use this issu...
SDDM Competitive Conditions Issue Vulnerability
SDDM is a Qt-based display manager for the desktop environments KDE and LXQt from the SSDM team. A contention condition issue vulnerability exists in versions of SDDM prior to 0.19.0. The vulnerability stems from incorrectly starting the X server in a way that would allow a local, unprivileged us...
Apple macOS Mojave has an unspecified vulnerability (CNVD-2020-65929)
Apple macOS Mojave is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Mojave versions prior to 10.14.4, which can be exploited by an attacker to intercept the contents of mime-encrypted emails...
