WAGO PFC200 Command Injection Vulnerability (CNVD-2020-16847)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A command injection vulnerability exists in the I/O-Check function of the iocheckd service in the WAGO PFC200. The vulnerability arises from a network system or product not properly filtering special characters, commands,...

Microsoft Hyper-V DoS

The vulnerability of Microsoft Hyper-V hardware virtualization technology and the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery Add Admin Description: Operator Can Change Role User Type to admin Date: 2020-02-26 Exploit Author: Meisam Monsef Vendor Homepage: https://www.bdtask.com/business-live-chat-software.php Version: V-1.0 Tested on: ubuntu...

Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin) Exploit

Exploit for php platform in category web applications Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery Add Admin Description: Operator Can Change Role User Type to admin Exploit Author: Meisam Monsef Vendor Homepage: https://www.bdtask.com/business-live-chat-software.ph...

CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

Design/Logic Flaw

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

CVE-2019-10790

taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found...

SAP BusinessObjects Business Intelligence XSS

The vulnerability of the SAP BusinessObjects Business Intelligence platform exists due to deficiencies in the encryption of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

SAP NetWeaver AS ABAP XSS

The vulnerability of the SAP NetWeaver AS ABAP software platform exists due to deficiencies in the encryption of data entered by users. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

PT-2020-1809

Name of the Vulnerable Software and Affected Versions LinuxKI versions 6.0-1 and earlier Description The issue is related to the lack of input data sanitization in the LinuxKI operating system, which can be exploited by a remote attacker to perform cross-site scripting XSS attacks. Recommendation...

Apache SpamAssassin Command Execution Vulnerability (CNVD-2020-07221)

Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An operating system command execution vulnerability exists in Apache SpamAssassin versions prior to 3.4.3. T...

Cisco IOS XR BGP DoS

The vulnerability of the BGP protocol implementation in Cisco IOS XR exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

SAP Enable Now XSS

The vulnerability of the SAP Enable Now platform exists due to deficiencies in the encryption of user-input data. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

ThinPro Linux VPN Arbitrary Command Execution

The vulnerability of the ThinPro Linux operating system’s VPN implementation exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary commands in superuser mode...

Memory corruption

The rtppacketizexiphconfig function in modules/streamout/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified...

CVE-2014-9630

The rtppacketizexiphconfig function in modules/streamout/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified...

PT-2020-1978

Name of the Vulnerable Software and Affected Versions SiTex affected versions not specified Description The issue is related to the file upload mechanism on the SiTex platform, which lacks input data sanitization. This could allow a remote attacker to upload malicious files to the server...

Hyper-V Hardware Virtualization DoS

The vulnerability of the Hyper-V hardware virtualization technology in the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

Huawei mobile phone software DoS

The vulnerability of Huawei’s mobile phone software exists due to insufficient testing of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...