Design/Logic Flaw

Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands...

Design/Logic Flaw

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service invalid read and use-after-free via a crafted keyring file...

Design/Logic Flaw

A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service...

Design/Logic Flaw

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents at the top most level, not recursively. The response included details about processors and controller services which the user may not have had read access to...

Design/Logic Flaw

tog-Pegasus has a package hash collision DoS vulnerability...

Design/Logic Flaw

Distributed Ruby aka DRuby 1.8 mishandles instanceeval...

Design/Logic Flaw

Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administrator who uploads a crafted upload.dat file...

Design/Logic Flaw

On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices...

Design/Logic Flaw

TemaTres 3.0 allows remote unprivileged users to create an administrator account...

Design/Logic Flaw

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification...

Design/Logic Flaw

The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.31 that allows any app co-located on the device to programmatically...

Design/Logic Flaw

The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to programmatically...

Design/Logic Flaw

The Samsung S7 Android device with a build fingerprint of samsung/heroltexx/herolte:8.0.0/R16NW/G930FXXS4ESC3:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000000, versionName=7.0.0.0 that allows other pre-installed apps to...

Design/Logic Flaw

poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack...

Design/Logic Flaw

In okToConnect of HidHostService.java, there is a possible permission bypass due to an incorrect state check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0...

Design/Logic Flaw

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack...

Design/Logic Flaw

An issue exists in thirdparty/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a removed smil element...

Design/Logic Flaw

atop: symlink attack possible due to insecure tempfile handling...

Design/Logic Flaw

Python Twisted 14.0 trustRoot is not respected in HTTP client...

Login and token disclosure to other Nextcloud services (NC-SA-2019-017)

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications...