17077 matches found
CVE-2019-7362
DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution...
Design/Logic Flaw
There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1...
Design/Logic Flaw
Former before 4.2.1 has XSS via a checkbox value...
Design/Logic Flaw
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection...
Design/Logic Flaw
The events-manager plugin before 5.5 for WordPress has XSS via EMTicket::getpost...
Design/Logic Flaw
In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times...
OpenSSH < 4.5 Multiple Vulnerabilities
Binary data 701165.prm...
Design/Logic Flaw
IBM Security Guardium Big Data Intelligence 4.0 SonarG does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417...
Design/Logic Flaw
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...
Design/Logic Flaw
An issue was discovered in fs/xfs/xfssuper.c in the Linux kernel before 4.18. A use after free exists, related to xfsfsfillsuper failure...
Design/Logic Flaw
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aacsendrawsrb does not initialize the reply structure...
WakaTime: [invalid][false-positive] csrftoken on profile page
step of reproduce- 1. Go to https://wakatime.com and create account. 2. login account after that go public profile. 3. after that change the full name and intercept brup suite and delete csrftoken. 4. After forward then you see name was changed. Impact Violation of Secure Design Principles...
Design/Logic Flaw
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging...
Design/Logic Flaw
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user...
Design/Logic Flaw
The readchunk function in flif-dec.cpp in Free Lossless Image Format FLIF 0.3 allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted flif file...
Design/Logic Flaw
Division by zero in the predictpoint function in stbvorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a crafted Ogg Vorbis file...
Microsoft Windows Text Services Framework MSCTF - Multiple Vulnerabilities
Microsoft Windows Text Services Framework MSCTF - Multiple Vulnerabilities The msctf subsystem is part of the Text Services Framework, The TSF manages things like input methods, keyboard layouts, text processing and so on. There are two main components, the ctfmon server and the msctf client. The...
Microsoft Windows Text Services Framework MSCTF - Multiple Vulnerabilities
The msctf subsystem is part of the Text Services Framework, The TSF manages things like input methods, keyboard layouts, text processing and so on. There are two main components, the ctfmon server and the msctf client. The ctfmon service creates an ALPC port in a well known location, to which...
Microsoft Windows Text Services Framework MSCTF - Multiple Vulnerabilities
The msctf subsystem is part of the Text Services Framework, The TSF manages things like input methods, keyboard layouts, text processing and so on. There are two main components, the ctfmon server and the msctf client. The ctfmon service creates an ALPC port in a well known location, to which...
Design/Logic Flaw
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain...