Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect client. This...

The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect its web page structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code in the user’s browser by creating a...

The vulnerability of the microprogramming software of the CloudEngine 1800V switch allows a intruder to trigger a maintenance failure.

The vulnerability of the CloudEngine 1800V microcontroller software is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to trigger a service failure through a specially crafted message...

CVE-2020-29000

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. An...

Code injection

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. An...

CVE-2020-27283

An attacker could send a specially crafted message to Crimson 3.1 Build versions prior to 3119.001 that could leak arbitrary memory locations...

CVE-2020-27283

CVE-2020-27283 affects Red Lion Crimson 3.1 (Builds prior to 3119.001). The described issue is an improper resource shutdown/release vulnerability that could leak arbitrary memory locations when a specially crafted message is processed. The 3.2.3 entry in ICSA-21-005-04 and related Red Hat/NVD re...

CVE-2020-27283

An attacker could send a specially crafted message to Crimson 3.1 Build versions prior to 3119.001 that could leak arbitrary memory locations...

CVE-2020-35858

An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service e.g., x86 or possibly remote code execution e.g., ARM...

CVE-2020-5806

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk...

Design/Logic Flaw

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk...

Cisco Jabber Input Validation Error Vulnerability

Cisco Jabber is the United States Cisco Cisco company's set of unified communications client solutions. The solution provides online status display, instant messaging, voice, and other features. Cisco Jabber suffers from an Input Validation Error vulnerability, which is caused by the software...

CVE-2020-25708

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service...

The vulnerability of the SSL/TLS microprogramming software-based network interface controllers in Cisco Firepower Threat Defense allows attackers to induce service failures.

The vulnerability of Cisco Firepower Threat Defense’s SSL/TLS microprogramming system check mechanisms arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a specially crafted and corrupted...

CVE-2019-8664

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted message may lead to a denial of service...

CVE-2020-9107

HUAWEI P30 Pro versions earlier than 10.1.0.160C00E160R2P8 have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be...

Race condition

The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication message to cause the daemon to read beyond allocated memory buffer, which would result in a denial of service condition...

CVE-2020-1894

A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk...

CVE-2020-5778

A flaw exists in Trading Technologies Messaging 7.1.28.3 ttmd.exe due to improper validation of user-supplied data when processing a type 8 message sent to default TCP RequestPort 10200. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to terminate...

CVE-2020-5778

A flaw exists in Trading Technologies Messaging 7.1.28.3 ttmd.exe due to improper validation of user-supplied data when processing a type 8 message sent to default TCP RequestPort 10200. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to terminate...