Cisco Jabber for Windows 安全漏洞

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. Cisco Jabber has a denial of service vulnerability that can be exploited by an attacker by sending a crafted XMPP message to the target...

Cisco Jabber 信息泄露漏洞

Cisco Jabber is a web conferencing and instant messaging application that allows users to send messages over the Extensible Messaging and Status Protocol XMPP. Cisco Jabber has an information disclosure vulnerability that can be exploited by an attacker by sending a crafted XMPP message to the...

CVE-2021-28154

Camunda Modeler aka camunda-modeler through 4.6.0 allows arbitrary file access. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which manipulates the readFile and writeFile APIs. NOTE: the vendor states "The way we secured the app is that it...

Input validation

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect client. This...

Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture HostScan Module is installed on the AnyConnect client. This...

The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.

The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect its web page structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code in the user’s browser by creating a...

The vulnerability of the microprogramming software of the CloudEngine 1800V switch allows a intruder to trigger a maintenance failure.

The vulnerability of the CloudEngine 1800V microcontroller software is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to trigger a service failure through a specially crafted message...

CVE-2020-29000

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. An...

Code injection

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the RTSP service that allows a remote attacker to take full control of the device with a high-privileged account. By sending a crafted message, an attacker is able to remotely deliver a telnet session. An...

CVE-2020-27283

An attacker could send a specially crafted message to Crimson 3.1 Build versions prior to 3119.001 that could leak arbitrary memory locations...

CVE-2020-27283

CVE-2020-27283 affects Red Lion Crimson 3.1 (Builds prior to 3119.001). The described issue is an improper resource shutdown/release vulnerability that could leak arbitrary memory locations when a specially crafted message is processed. The 3.2.3 entry in ICSA-21-005-04 and related Red Hat/NVD re...

CVE-2020-27283

An attacker could send a specially crafted message to Crimson 3.1 Build versions prior to 3119.001 that could leak arbitrary memory locations...

CVE-2020-35858

An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message, causing a denial of service e.g., x86 or possibly remote code execution e.g., ARM...

CVE-2020-5806

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk...

Design/Logic Flaw

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by sending a specially crafted message to 127.0.0.1:7153. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk...

Cisco Jabber Input Validation Error Vulnerability

Cisco Jabber is the United States Cisco Cisco company's set of unified communications client solutions. The solution provides online status display, instant messaging, voice, and other features. Cisco Jabber suffers from an Input Validation Error vulnerability, which is caused by the software...

CVE-2020-25708

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service...

The vulnerability of the SSL/TLS microprogramming software-based network interface controllers in Cisco Firepower Threat Defense allows attackers to induce service failures.

The vulnerability of Cisco Firepower Threat Defense’s SSL/TLS microprogramming system check mechanisms arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a specially crafted and corrupted...

CVE-2019-8664

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted message may lead to a denial of service...

CVE-2020-9107

HUAWEI P30 Pro versions earlier than 10.1.0.160C00E160R2P8 have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be...