3665 matches found
CVE-2019-0316
SAP NetWeaver Process Integration, versions: SAPXIESR: 7.20, SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled inputs, which allows an attacker possessing admin privileges to read and modify data from the victim’s browser, by injecting malicious scrip...
Schneider Electric Modicon M580 UnityPro reliance on untrusted inputs vulnerability
Summary An exploitable reliance on untrusted inputs vulnerability exists in the strategy transfer function of the Schneider Electric Unity Pro L Programming Software. When a specially crafted strategy is programmed to a Modicon M580 Programmable Automation Controller, and UnityProL is used to rea...
Cloudera Data Science Workbench SQL Injection Vulnerability
Cloudera Data Science Workbench CDSW is a suite of data science platforms from Cloudera. The platform provides organizations with fast, easy and secure self-service data science support. A SQL injection vulnerability exists in Cloudera CDSW versions 1.4.0 through 1.4.2. The vulnerability stems fr...
Fuzzing: Common Tools and Techniques
Fuzzing is a software testing methodology that can be used from either a black or white box perspective and predominantly consists of providing deliberately malformed inputs to an application to identify errors such as unhandled exceptions, memory spikes, thread hangs, read access violations or...
curl: Signed integer overflow in tool_progress_cb()
Summary: Good afternoon curl security! I built this curl from commit 8144ba38c383718355d8af2ed8330414edcbbc83. We discovered a signed integer overflow in toolprogresscb. Steps To Reproduce: Compiled with the Undefined Behavior Sanitizer enabled. Ran with the following command line: ./curl -q - -T...
Design/Logic Flaw
A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software...
Integer overflows in URL parser
libcurl contains two integer overflows in the curlurlset function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32-bit architectures and require excessive string input lengths...
CVE-2019-11033
Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the substring...
CVE-2019-11033
Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the substring...
Design/Logic Flaw
Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the substring...
Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability
A Cross-site Scripting XSS vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to an Azure DevOps server or a Team Foundation server,...
CVE-2018-12303
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names...
Emerson 396897-03-7 Non-isolated Mixed Input/Output module Detection
Binary data 756522.prm...
Mitsubishi R16MTCPU PLC Detection
Binary data 751833.prm...
Siemens CPU 1511C-1 PN PLC Detection
Binary data 756640.prm...
Schweitzer Engineering Laboratories AC Protection Module Detection
Binary data 755363.prm...
Emerson 396570-06-2 Non-isolated High Speed Counter Detection
Binary data 756515.prm...
Siemens CPU-1511C-1 PN PLC Detection
Binary data 750168.prm...