The vulnerability of the central control server of SiNVR 3 Central Control Server lies in security flaws in the XML-based communication protocol, allowing attackers to perform arbitrary actions on the vulnerable device.

The vulnerability of the central control server of SiNVR 3 Central Control Server is related to security vulnerabilities in the XML-based communication protocol. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device remotely...

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

keycloak: SAML broker does not check existence of signature on document allowing any user impersonation

It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to...

chromium-browser: Use after free in storage

Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

The vulnerability of Google Chrome browsers, related to reading beyond the buffer in memory, allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.

The vulnerability of Google Chrome’s browser involves reading data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to information and compromise its integrity and availability through a specially created HTML page...

The vulnerability of the Blink web browser component in Google Chrome, which allows a hacker to compromise data integrity

The vulnerability of the Blink web browser component in Google Chrome is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows an attacker to affect data integrity through a specially created HTML page...

USN-4337-1 openjdk-8, openjdk-lts vulnerabilities

It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. CVE-2020-2754, CVE-2020-2755 It was discovered that OpenJDK incorrectly handled class...

The vulnerability in the user interface of Google Chrome’s Chromium browser allows a hacker to compromise data integrity.

The vulnerability of Google Chrome’s Chromium user interface is related to improper control over access to critical resources. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

chromium-browser: Type Confusion in V8

Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

SAP Commerce Input Validation Error Vulnerability

SAP Commerce is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management and operations management. An input validation error vulnerability exists in SAP Commerce that stems from the Rest API program not securely...

DEBIAN-CVE-2020-6443

Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page...

UBUNTU-CVE-2020-6431

Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page...

UBUNTU-CVE-2020-6444

Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the security interface of Google Chrome’s pop-up blockers allows attackers to compromise data integrity.

The vulnerability of the security interface of Google Chrome’s pop-up blockers is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise data integrity through a specially created HTML page...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Advantech WebAccess/NMS Input Validation Error Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. An input validation error vulnerability exists in Advantech WebAccess/NMS, which can be exploited by an attacker to obtain sensitive information via specially crafted XML input...

CVE-2019-4391

HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...

CVE-2019-9163

The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects...

Google Chrome memory misreference vulnerability (CNVD-2020-19204)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A memory misreference vulnerability exists in audio in versions prior to Google Chrome 80.0.3987.149. A remote attacker can exploit this vulnerability to leverage...

The vulnerability of the RDP connection manager, Remote Desktop Connection Manager (RDCMan), related to improper processing of XML data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the RDP connection manager, Remote Desktop Connection Manager RDCMan, is related to incorrect processing of XML data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using a file with the RDG...