CVE-2019-0089

Improper data sanitization vulnerability in subsystem in IntelR SPS before versions SPSE504.00.04.381.0, SPSE304.01.04.054.0, SPSSoC-A04.00.04.181.0, and SPSSoC-X04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access...

Input validation

Improper data sanitization vulnerability in subsystem in IntelR SPS before versions SPSE504.00.04.381.0, SPSE304.01.04.054.0, SPSSoC-A04.00.04.181.0, and SPSSoC-X04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2019-0089

Improper data sanitization vulnerability in subsystem in IntelR SPS before versions SPSE504.00.04.381.0, SPSE304.01.04.054.0, SPSSoC-A04.00.04.181.0, and SPSSoC-X04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2019-0093

CVE-2019-0093 is an information-disclosure vulnerability in Intel® CSME/HECI and Intel® SPS. The issue is caused by insufficient data sanitization in the HECI subsystem and affects Intel® CSME before 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel® SPS before SPS_E3_05.00.04.027.0, potentially all...

CVE-2019-0089

CVE-2019-0089 affects Intel Server Platform Services (SPS) and related Intel CSME/SPS components. The issue is an improper data sanitization vulnerability in SPS subsystems prior to SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 that may allow...

CVE-2019-0093

Insufficient data sanitization vulnerability in HECI subsystem for IntelR CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and IntelR SPS before version SPSE305.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access...

Design/Logic Flaw

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...

CVE-2019-6340

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...

CVE-2019-6340

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...

CVE-2019-6340 Drupal core - Highly critical - Remote Code Execution

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...

CVE-2019-6340

CVE-2019-6340 is a Drupal core remote code execution vulnerability affecting Drupal 8.5.x before 8.5.11 and 8.6.x before 8.6.10 when the RESTful Web Services (rest) module is enabled and PATCH/POST requests are allowed, or when other web services modules (e.g., JSON:API, Services, RESTful Web Ser...

CVE-2019-6340

Removed by vendor...

Drupal core - Highly critical - Remote Code Execution

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...

Cross site scripting

yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting XSS vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection Cross-Site Scripting. This attack appears to be exploitable via the payload needs ...

LAquis SCADA Web Server relatorionome TAG Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to relatorionome.lhtml. When parsing the TAG Element, th...

MGASA-2019-0007 Updated units package fixes security vulnerability

A flaw was found in units. unitscur doesn't sanitize downloaded data. This allows a maliciously intended server to execute arbitrary code remotely on the client rhbz1598913...

Fedora 28 : mysql-mmm (2018-ca5321b5ff)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

PT-2018-13581 · Php Scripts Mall · Php Scripts Mall Website Seller Script

Name of the Vulnerable Software and Affected Versions: PHP Scripts Mall Website Seller Script version 2.0.5 Description: The issue concerns a cross-site scripting XSS problem. XSS is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website, potentiall...

WordPress FV Flowplayer 7.2.0.727 Cross Site Scripting

waraxe-2018-SA107 - Reflected XSS in FV Flowplayer Wordpress plugin ================================================================================ Author: Janek Vind "waraxe" Date: 20. September 2018 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-107.html Target description: FV...

CVE-2018-14799

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, the PageWriter device does not sanitize data entered by user. This can lead to buffer overflow or format string vulnerabilities...