Memory corruption

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

Memory corruption

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

Code injection

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.020190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database...

Vulnerability of the Server component: The Oracle MySQL Server database management system’s DML component, which is vulnerable due to insufficient input data validation. This allows attackers to cause system downtime or service failures.

The vulnerability of the Oracle MySQL Server component relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause downtime or service failures using the MySQL network protocol...

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion

Summary Digital Signage Software. Description Input passed to the 'data' parameter in 'QH.aspx' for delete action is not properly sanitised before being used to delete files. This can be exploited by an unauthenticated attacker to delete files with the permissions of the web server using their...

CVE-2020-16227

Delta Electronics TPEditor is affected (Versions 1.97 and earlier) by CVE-2020-16227 due to improper input validation during parsing of TPE files. The root cause is unvalidated user-supplied data in specially crafted project files, which can lead to read/modify of data, arbitrary code execution, ...

Vulnerabilities fixed in Cisco AnyConnect Secure Mobility Client

Vulnerabilities have been fixed in Cisco AnyConnect Secure Mobility Client for Windows. The vulnerabilities allow a local malicious person with valid Windows login credentials to perform attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Data...

CVE-2020-15103

In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data th...

CVE-2020-15884

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order0dir field on POST requests to /datatables/data...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2020-41470)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the Server: DML component of MySQL Server 8.0.20 and earlier versions of Oracle MySQL. An attacker could exploit...

CVE-2020-14660

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite component: Preferences. Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM...

CVE-2020-14564

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Environment Mgmt Console. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

CVE-2020-14566

Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0 and 19.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

CVE-2020-14528

Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 16.1.0.0-16.1.5.1, 18.0.0.0-18.0.2.0 and 19.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

Design/Logic Flaw

Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite component: Setup of Mobile Applications. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

Design/Logic Flaw

Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM component: SWSE Server. Supported versions that are affected are 20.6 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful...

CVE-2020-2977

CVE-2020-2977 affects Oracle Database Server via the Application Express (APEX) component. Affected: APEX versions 5.1–19.2. The vulnerability is exploitable by a low-privilege user with a Valid User Account, who can access the server over HTTP and requires user interaction. Consequences include ...

CVE-2020-2982

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.3.0.0 and 13.4.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2020-2966

CVE-2020-2966 affects Oracle WebLogic Server Console in 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. An unauthenticated attacker with network access via HTTP can compromise WebLogic Server; exploitation requires user interaction and can lead to unauthorized update/insert/delete and read acc...