632 matches found
CVE-2017-15392
Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry, related to PlatformIntegration...
CVE-2017-15392
CVE-2017-15392 relates to Google Chrome/Chromium on Windows and is caused by an incorrect registry key handling in the PlatformIntegration component prior to 62.0.3202.62. A crafted Windows Registry entry could allow heap corruption, potentially enabling code execution or stability issues as desc...
chromium-browser: xss in devtools
Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension...
DEBIAN-CVE-2017-14056
In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2readheader due to lack of an EOF End of File check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "framecount" field in the header but does not contain sufficient backing data, is provided, the loops for...
CVE-2016-10223
CVE-2016-10223 – BigTree CMS XSS in id parameter . Affected software: BigTree CMS prior to 4.2.15. The vulnerability stems from insufficient filtration of user-supplied data in the GET parameter id passed to core/admin/adjax/dashboard/check-module-integrity.php, allowing an attacker to inject arb...
Royal Slider <= 3.2.6 - Authenticated Cross-Site Scripting (XSS)
The vulnerability exists due to insufficient sanitation of user-supplied data in "rstype" HTTP GET parameter when creating / editing a slider. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of...
Debian DLA-242-1 : imagemagick security update
This update fixes a large number of potential security problems due to insufficient data validation when parsing different input formats. Most of those potential security problems do not have a CVE number assigned. While the security implications of all of these problems are not all fully known, ...
DLA-242-1 imagemagick - security update
Bulletin has no description...
CVE-2014-9715
include/net/netfilter/nfconntrackextend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service NULL pointer dereference and OOPS via outbound network traffic that...
Community Link Pro Login.CGI File Parameter Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14097/info Community Link Pro is prone to a remote arbitrary command execution vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. Due to this, an attacker can prefix arbitrar...
Uni-vert PhpLeague 0.82 Joueurs.PHP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19880/info Uni-vert PhpLeague is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data. This issue may allow an attacker to compromise the application, access or modify data,...
FuseTalk Forum 4.0 - Multiple Cross-Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/11407/info FuseTalk Forum is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks. The cause of these issues is insufficient...
Go Smart Inc GoSmart Message Board Multiple Input Validation Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/11361/info GoSmart Message Board is reported prone to multiple input validation vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting and SQL injection attacks. The cause of these iss...
BosDev BosDates 3.x SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9639/info An SQL injection vulnerability has been reported to affect BosDates calendar system. The issue arises due to insufficient sanitization of user supplied data. As a result of this issue an attacker could modify th...
cPanel 5.0 Guestbook.cgi Remote Command Execution Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attack...
Iwebsns sql 第二枚。
简要描述： 过滤不严。 详细说明： 在action/users/userinfo.action.php中 $userid =getsessuserid; $model = shortcheckgetargg'model'; $birthyear = shortcheckgetargp'birthyear'; $birthmonth = shortcheckgetargp'birthmonth'; $birthday = shortcheckgetargp'birthday'; $residecity = shortcheckgetargp'residecity';...
Clix'N'Cash Clone 2010 - 'index.php' SQL Injection
source: https://www.securityfocus.com/bid/41202/info Clix'N'Cash Clone 2010 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access ...
Design/Logic Flaw
The ParamTraits::Read function in common/commonparamtraits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data, which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data,...
CVE-2010-0663
The ParamTraits::Read function in common/commonparamtraits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data, which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data,...
Input validation
The Graphics Device Interface GDI in win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, a...