CVE-2019-12366

The vulnerability CVE-2019-12366 affects the Nine Android app up to version 4.5.3a. The issue is an XSS via an event attribute and an arbitrary file loading via a src attribute when the app has READ_EXTERNAL_STORAGE permission. The Red Hat advisory reiterates this description. No concrete exploit...

CVE-2019-12365

The CVE-2019-12365 entry affects the Newton Android app (version up to 10.0.23). It describes two issues: (1) XSS via an event attribute and (2) arbitrary file loading via a src attribute when the app holds READ_EXTERNAL_STORAGE permission. The related Red Hat/NVD entries confirm these descriptio...

CVE-2019-12365

The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12367: Improper Neutralization of Input During Web Page Generation

The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12365: Improper Neutralization of Input During Web Page Generation

The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12368: Improper Neutralization of Input During Web Page Generation

The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12366: Improper Neutralization of Input During Web Page Generation

The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12369: Improper Neutralization of Input During Web Page Generation

The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12370: Improper Neutralization of Input During Web Page Generation

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

Foxit PDF Editor DLL Hijacking Vulnerability

Foxit PDF Editor is a PDF file editing software. Foxit PDF Editor has a DLL hijacking vulnerability. An attacker can exploit this vulnerability to load a fake malicious dll file...

Denial Of Service (DoS)

wordpress is vulnerable to denial of service. The vulnerability exists in because an unauthenticated attacker is able to crash the application by submitting a large list of registered .js files to cause each file to be loaded multiple times, leading to excessive resource consumption...

The vulnerabilities of McAfee Total Protection (MTP), McAfee Anti-Virus Plus (AVP), and McAfee Internet Security (MIS) software lie in their shortcomings regarding the loading of external files and the verification of their digital signatures. This allows attackers to exploit these vulnerabilities to enhance their privileges and execute malicious code.

The vulnerabilities of McAfee Total Protection MTP, McAfee Anti-Virus Plus AVP, and McAfee Internet Security MIS are related to deficiencies in loading external files from inappropriate directories and verifying their digital signatures. Exploiting these vulnerabilities can allow attackers to...

CVE-2019-15346: Exposure of Resource to Wrong Sphere

The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

Information disclosure

Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance ASA could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established. For more information about these...

CVE-2019-9116

DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublimetext.exe to open a .txt file within an attacker's...

CVE-2018-1000889

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity XXE vulnerability in Circuit file loading functionality loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java that can result in information leak, possible RCE depending on system configuration. This attack appears t...

Xxe

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity XXE vulnerability in Circuit file loading functionality loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java that can result in information leak, possible RCE depending on system configuration. This attack appears t...

Logisim Evolution XML External Entity Injection Vulnerability

Logisim Evolution is a tool for designing and simulating data logic circuits. An XML external entity injection vulnerability exists in the Circuit file loading feature in Logisim Evolution 2.14.3 and earlier versions, which can be exploited by an attacker to disclose information and potentially...

The vulnerability of Watchguard’s wireless access points’ microprogramming software lies in the lack of sufficient file loading restrictions, allowing attackers to execute arbitrary commands.

The vulnerability of the microprogrammed software of Watchguard wireless access points relates to insufficient restrictions on file downloads. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary commands...

Microsoft Windows Image File Loading CVE-2018-8475 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition. Technologies Affected Microsoft Windows ...