WordPress WP-Planet Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP-Planet is one of the plugins used in it. WordPress WP-Planet 0.1 and earlier versions of the rss.class/scripts/magpiedebug.php...

GitLab EE Cross-Site Scripting Vulnerability (CNVD-2020-03767)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

libsixel buffer overflow vulnerability (CNVD-2020-01922)

libsixel is a package that provides encoding/decoding implementations for DEC SIXEL graphics and other converter programs. A buffer overflow vulnerability exists in the 'gifoutcode' function of the fromgif.c file in libsixel version 1.8.4. The vulnerability stems from a networked system or produc...

WordPress Laborator Neon theme cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Laborator Neon theme is used in one of the back-end website management theme plugin. A cross-site scripting vulnerability exists in...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

NETCORE Netis DL4323 Cross-Site Scripting Vulnerability (CNVD-2020-01648)

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site scripting vulnerability exists in the NETCORE Netis DL4323, which stems from the lack of proper validation of client data by the WEB application, and can be exploited by an attacker to execute client code...

WebKit component buffer overflow vulnerability in multiple Apple products (CNVD-2020-00207)

Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. apple macOS Mojave is a specialized operating system developed for Mac computers. webKit is one of the web browser WebKit is a Web browser engine component. A buffer overflow...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-01155)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the module editor in WordPress versions prior to 5.3.1. The...

GraphicsMagick 'EncodeImage' function buffer overflow vulnerability

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A buffer overflow vulnerability exists in the 'EncodeImage' function of the coders/pict.c file in GraphicsMagick. The vulnerability stems from a networked...

ImageMagick Studio ImageMagick Buffer Overflow Vulnerability (CNVD-2020-00276)

ImageMagick Studio ImageMagick is a suite of open-source image processing software from the American company ImageMagick Studio. The software can read, convert or write images in a variety of formats. ImageMagick Studio ImageMagick suffers from a buffer overflow vulnerability. The vulnerability...

NetHack Buffer Overflow Vulnerability (CNVD-2019-47432)

NetHack is a role-playing single-player game. A buffer overflow vulnerability exists in NatHack versions 3.6.0 through 3.6.3. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting in incorrect read and wri...

Backdrop CMS Cross-Site Scripting Vulnerability (CNVD-2020-03708)

Backdrop CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Backdrop CMS version 1.13.x before 1.13.5 and version 1.14.x before 1.14.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker...

CVE-2019-10614

Out of boundary access is possible as there is no validation of data accessed against the received size of the packet in case of malicious firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon...

CVE-2019-10614

CVE-2019-10614 affects Qualcomm Snapdragon firmware across many devices (Auto/Compute/Connectivity, etc.). Root cause: no validation of data length against received packet size in malicious firmware, leading to out-of-bounds access. Impact stated as high-risk, with network attack vector and parti...

SolarWinds Serv-U FTP Server Cross-Site Scripting Vulnerability (CNVD-2019-46256)

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A cross-site scripting vulnerability exists in SolarWinds Serv-U FTP Server version 15.1.7. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker coul...

openSUSE Security Update : chromium (openSUSE-2019-2692)

This update for chromium fixes the following issues : Chromium was updated to 79.0.3945.79 boo1158982 - CVE-2019-13725: Fixed a use after free in Bluetooth - CVE-2019-13726: Fixed a heap buffer overflow in password manager - CVE-2019-13727: Fixed an insufficient policy enforcement in WebSockets -...

MediaWiki VisualEditor Cross-Site Scripting Vulnerability

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. The product can be used to deploy in-house knowledge management and content management systems.VisualEditor is a rich text editor extension used in it. A cross-site...

Advantech DiagAnywhere FOLDER_CREATE Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech DiagAnywhere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of FOLDERCREATE messages. The issue results from the lack of proper...

Lenovo Power Management Driver Denial of Service Vulnerability

Lenovo Power Management is a system designed by Lenovo specifically for notebook computers to manage notebook power. It provides control of the performance and power consumption of various components of the laptop through a combination of software and hardware. A denial of service vulnerability...

The vulnerability of the Intel Graphics Driver’s API driver component allows a hacker to trigger a service failure.

The vulnerability of the Intel Graphics Driver’s API driver component exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...