CVE-2019-18910

The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges...

Unspecified Vulnerability in SAP Financial Consolidation

SAP Financial Consolidation is a financial statement solution from SAP. The product is designed to automate intercompany reconciliations and offsets, currency conversions, and provide financial statement generation. An unspecified vulnerability exists in SAP Financial Consolidation. The...

The vulnerability of the SubTypeValidator.java file in the Jackson-databind library allows a hacker to execute arbitrary code.

The vulnerability of the SubTypeValidator.java file in the Jackson-databind library is related to incorrect default input handling. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2010-3438

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server...

Rockwellautomation Rslinx Out-of-bounds Read

Rockwell Automation RSLinx Enterprise Software LogReceiver.exe CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it calculates an incorrect value for the “Total Record Size” field. By sending a datagram...

USN-4176-1: GNU cpio vulnerability

Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege escalation...

USN-4176-1 cpio vulnerability

Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege escalation...

Ubuntu: Security Advisory (USN-4175-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4168-1 libidn2 vulnerabilities

It was discovered that Libidn2 incorrectly handled certain inputs. A attacker could possibly use this issue to impersonate domains. CVE-2019-12290 It was discovered that Libidn2 incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. CVE-2019-18224...

The numerous vulnerabilities of the Webvrpcs software, a remote monitoring solution from Advantech, allow a intruder to execute arbitrary code.

The multiple vulnerabilities of the Webvrpcs software for remote monitoring by Advantech WebAccess are related to deficiencies in the validation of input data before it is copied into a fixed-length buffer. Exploiting these vulnerabilities could allow a malicious actor to execute arbitrary code...

CVE-2019-16971

In FusionPBX up to 4.5.7, the file app\messages\messagesthread.php uses an unsanitized "contactuuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS...

CVE-2019-16970

In FusionPBX up to 4.5.7, the file app\sipstatus\sipstatus.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS...

USN-4160-1 uw-imap vulnerability

It was discovered that UW IMAP incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

UBUNTU-CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

USN-4155-1 aspell vulnerability

It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information...

CVE-2019-0377

SAP BusinessObjects Business Intelligence Platform Web Intelligence HTML interface, before versions 4.2, does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls, resulting in Stored Cross-Site Scripting...

D-Link DBA-1510P OS Command Injection Vulnerability (CNVD-2019-36969)

The D-Link DBA-1510P is a wireless access point device from Taiwan, China-based AUO D-Link. An operating system command injection vulnerability exists in the CLI of D-Link DBA-1510P versions using firmware version 1.70b009 and earlier, which can be exploited by an attacker to execute illegal...

The vulnerability of the fly-admin-local component in the FLY operating system environment of the Astra Linux platform involves incorrect processing of input data. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the fly-admin-local component in the FLY operating system environment of Astra Linux is related to the malfunction of the utility when the network is disconnected. Additionally, there is an incorrect interpretation of parameters in the configuration files for pam-tally and...

CVE-2019-11744

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...