CVE-2020-4689

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

UBUNTU-CVE-2020-13335

Improper group membership validation when deleting a user account in GitLab =7.12 allows a user to delete own account without deleting/transferring their group...

Improper Validation

mariadb-connector-c is using improper validation of content in a OK packet received from server...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Plexus-utils (CVE-2017-1000487)

Summary Plexus-utils could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input. By sending contents with double quoted strings, an attacker could exploit this vulnerability to execute arbitrary commands on the system...

Arbitrary Code Execution

webkitgtk4 is vulnerable to arbitrary code execution. The vulnerability exists through an improper validation...

Foxit PhantomPDF Remote Code Execution Vulnerability (CNVD-2020-62459)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. A remote code execution vulnerability exists in Foxit PhantomPDF's handling of U3D objects embedded in PDF files. The vulnerability stems from improper validation of user-supplied data. An...

Foxit PhantomPDF Information Disclosure Vulnerability (CNVD-2020-62458)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. An information disclosure vulnerability exists in Foxit PhantomPDF's handling of U3D objects embedded in PDF files. The vulnerability stems from improper validation of user-supplied data. A...

Security Bulletin: Vulnerability in Apache Commons Codec affects IBM Operations Analytics Predictive Insights

Summary Apache Commons Codec is used by IBM Operations Analytics Predictive Insights. Apache Commons Codec vulnerability 177835 could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. This vulnerability affects IBM Operations Analytics Predictive...

Trend Micro Apex One Information Disclosure Vulnerability (CNVD-2020-58784)

Trend Micro Apex One is an endpoint protection solution that offers the broadest range of protection capabilities, including high-accuracy machine learning and advanced ransomware protection. An information disclosure vulnerability exists in the parsing of ZIP files in the ServerMigrationTool...

Security Bulletin: Apache Commons Codec Vulnerability Affects IBM Control Center

Summary Apache Commons Codec could allow a remote attacker to obtain sensitive information, caused by the improper validation of input. Vulnerability Details Third Party Entry: 177835 DESCRIPTION: Apache Commons Codec information disclosure CVSS Base score: 7.5 CVSS Temporal Score: See:...

Zomato: Improper Validation at Partners Login

Timeline | Timeline | Action | |---|---| | Thu, 24 Sep 2020, 12:10 IST | Researcher submitted the report on H1 with initial severity as High. | | Thu, 24 Sep 2020, 12:32 IST | First response - we asked for clarification via demonstration on attack scenarios. Parallelly, we began our own...

Input validation

A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit...

CVE-2020-3133 Cisco Email Security Appliance Content Filter Bypass Vulnerability

A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit...

CVE-2020-3133 Cisco Email Security Appliance Content Filter Bypass Vulnerability

A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper validation of incoming emails. An attacker could exploit...

Atlassian Jira 8.0 < 8.9.1 XSS in Quick Search (JRASERVER-71205)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 8.x prior to 8.9.1. It is, therefore, affected by a cross-site scripting XSS vulnerability in the quick search component due to improper validation of user-supplied input befor...

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...

CloudBees Jenkins chosen-views-tabbar Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

Remote code execution

A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticate...

Ecommerce CodeIgniter Bootstrap cross-site scripting vulnerability (CNVD-2020-51508)

Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript.CodeIgniter is an open source web framework written using the PHP language . A cross-site scripting vulnerability exists in application/modules/admin/views/blog/blogpublish.php in Ecommerce CodeIgniter...

CVE-2020-6330

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation...