Google Chrome Information Disclosure Vulnerability (CNVD-2019-36922)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 77.0.3865.120. The vulnerability can be exploited by an attacker to obtain sensitive information with the help of a specially crafted website...

ncurses buffer overflow vulnerability (CNVD-2020-13676)

ncurses is a character terminal processing library , it can provide a series of functions for the user to call and generate text-based user interface . A buffer overflow vulnerability exists in the 'ncfindentry' function in the tinfo/comphash.c file of the terminfo library in versions prior to...

Google Chrome V8 Resource Management Error Vulnerability (CNVD-2019-36924)

Google Chrome is a web browser of Google Google, U.S. V8 is one of the open source JavaScript engine. A resource management error vulnerability exists in V8 in versions of Google Chrome prior to 77.0.3865.120. The vulnerability can be exploited by an attacker with the help of a specially crafted...

Atlassian Crowd Input Validation Error Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. An input validation error vulnerability exists in Atlassian Crowd versions prior to...

SugarCRM 9.0.1 Cross Site Scripting

------------------------------------------------------------------------- SugarCRM = 9.0.1 Multiple Reflected Cross-Site Scripting Vulnerabilities ------------------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1...

cPanel cross-site scripting vulnerability (CNVD-2019-34458)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the LiveAPI sample script in versions prior to cPanel 82.0.15. The vulnerability...

PT-2019-15171 · Pdf Xchange · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor versions prior to 8.0.330.0 Description: The issue allows for NTLM SSO hash theft using crafted FDF or XFDF files. This can occur when a link to a file, such as '192.168.0.2C$file.pdf', is accessed without user interaction,...

WordPress mtouch-quiz plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. mtouch-quiz is a multiple choice quiz plugin used in it. A cross-site request forgery vulnerability exists in WordPress mtouch-quiz...

PT-2019-5855 · Imagemagick +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.9-0 Description: The issue is related to multiple unconstrained pixel offset calculations in functions CatromWeights, MeshInterpolate, InterpolatePixelChannel, InterpolatePixelChannels, and InterpolatePixelIn...

Netskope Client Command Injection Vulnerability

Netskope Client is a client program for connecting to and managing the Netskope Cloud Platform from Netskope USA. A command injection vulnerability exists in the connection handling functionality in Netskope Client versions 57 prior to 57.2.0.219 and 60 prior to 60.2.0.214. The vulnerability aris...

CVE-2019-11656

Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2019-17133

In the Linux kernel through 5.3.2, cfg80211mgdwextgiwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow...

DEBIAN-CVE-2019-15163

rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service NULL pointer dereference and daemon crash if a crypt call fails...

PT-2019-5856 · Imagemagick +5 · Imagemagick +5

Name of the Vulnerable Software and Affected Versions: ImageMagick versions prior to 7.0.8-68 Description: A floating point math calculation in the ScaleAnyToQuantum function of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a value outside the range of type unsigne...

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution

A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

CVE-2019-16743

eBrigade before 5.0 has evenementical.php evenement SQL Injection...

CVE-2019-11737

If a wildcard '' is specified for the host in Content Security Policy CSP directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox 69...

CVE-2019-11733

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password ...

SilverStripe Cross-Site Scripting Vulnerability (CNVD-2019-40592)

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . SilverStripe 4.3.3 and previous versions of cross-site scripting vulnerability. The...

CVE-2019-6161

An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB Storage Block BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain...