2308 matches found
The vulnerability of Google Chrome’s browser, related to writing beyond the memory buffer, allows attackers to bypass the sandboxing protection mechanism.
The vulnerability of Google Chrome relates to the writing beyond the memory buffer. Exploiting this vulnerability allows a malicious actor to bypass the sandboxing mechanism by using a specially crafted HTML page...
CloudBees Jenkins Subversion Code Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A code issue vulnerability...
Cisco SD-WAN vManage XML External Entity Injection Vulnerability (CNVD-2020-66211)
Cisco SD-WAN Solution is a suite of network extension solutions from Cisco, of which vManage is the console. An XML external entity injection vulnerability exists in the web UI of Cisco SD-WAN vManage 20.1.12 and earlier. The vulnerability stems from improper handling of XML External Entity XXE...
expat: large number of colons in input makes parser consume high amount of resources, leading to DoS
It was discovered that the "setElementTypePrefix" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of service...
DEBIAN-CVE-2020-15968
Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
VulnCheck KEV: CVE-2020-16009
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft...
SAP NetWeaver Input Validation Error Vulnerability
SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An input validation error vulnerability exists in SAP NetWeaver Compare Systems versions 7.20, 7.30, 7.40, and...
Authentication flaw
When Security Assertion Markup Language SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certificates which could allow a malicious network-based user to access unauthorized data. This issue affects all Juniper Networks Mist Cloud UI...
The vulnerability of the CMC module of the SAP BusinessObjects Business Intelligence platform allows a hacker to disclose protected information or cause service interruptions.
The vulnerability of the CMC module of the SAP BusinessObjects Business Intelligence platform is related to errors in processing XML requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failures...
chromium-browser: Inappropriate implementation in V8
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-4774
An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information su...
IBM Cúram Social Program Management Access Control Error Vulnerability
IBM Cúram Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A security vulnerability exists in IBM Cúram Social Program Management XPath, which arises from errors such as...
The vulnerability of the Google Chrome and Sailfish Browser rendering process allows a hacker to trigger a service failure or execute arbitrary code.
The vulnerability of the Google Chrome and Sailfish Browser rendering process is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure or execute arbitrary code by deleting the current embedded HTML obje...
Open-Xchange: XSS - Notes - Attribute injection through overlapping tags
The Notes app uses simple markup language to format the content, which is later converted to HTML for display. javascript // frontend/ui/apps/io.ox/notes/parser.js parsePlainText: function text var lines = .escapetext.split/\n/, openList; ... var html = lines.join'' .replace/!\.?/g, ''...
DEBIAN-CVE-2020-6573
Use after free in video in Google Chrome on Android prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...
UBUNTU-CVE-2020-15964
Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2020-15772
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities XXE, allowing a remot...
SAP NetWeaver Application Server Java Cross-Site Scripting Vulnerability
SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server Java XML Forms versions 7.30, 7.31, 7.40, 7.50, which arises from a lack of proper validation of client-side data in the web application. An...
chromium-browser: Insufficient policy enforcement in intent handling
Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...