6696 matches found
mysql: C API unspecified vulnerability (CPU Jan 2020)
Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...
CVE-2020-27029
In TextView of TextView.java, there is a possible app hang due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140218875...
OpenAsset Digital Asset Management XSS Injection Vulnerability
Openasset is a digital asset management software for the website building industry from Openasset UK. The OpenAsset Digital Asset Management software product suffers from an XSS injection vulnerability that could allow a remote attacker to inject arbitrary JavaScript or HTML for later rendering b...
Gallagher Group Command Centre Code Issue Vulnerability
Gallagher Group Command Centre is a centralized control tool for Gallagher access control systems from Gallagher Group of New Zealand. A security vulnerability exists in Gallagher Group Command Centre that could be exploited by a remote attacker to crash the server or potentially cause remote cod...
The vulnerability of the AvailableApps.php component in the microprogramming software for the Western Digital MyCloud NAS allows a intruder to execute arbitrary code.
The vulnerability of the AvailableApps.php component in the microprogramming software of Western Digital’s MyCloud NAS storage system is related to insecure privilege management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Ruckus IoT Controller Web UI Command Injection (CVE-2020-26878)
A remote command injection vulnerability exists in Ruckus IoT Controller Web UI. The vulnerability is due to improper handling of a crafted HTTP request...
TP-Link TL-WPA4220 缓冲区错误漏洞
The TP-Link TL-WPA4220 is a 300Mbps AV600 Wi-Fi powerline extender. A buffer overflow vulnerability exists in the TP-Link TL-WPA4220. A remote attacker can exploit this vulnerability by sending a POST request to the /admin/syslog endpoint to cause a denial of service...
pocsuite3
This is a Python package called pocsuite3, which is a remote vulnerability testing and proof-of-concept development framework. It is developed by the Knownsec 404 Team and comes with a powerful proof-of-concept engine, many powerful features for penetration testers and security researchers. The...
CVE-2020-11860
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting XSS...
USN-4622-2 openldap vulnerability
USN-4622-1 fixed a vulnerability in OpenLDAP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that OpenLDAP incorrectly handled certain network packets. A remote attacker could use this issue to cause OpenLDAP t...
CVE-2020-7128
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...
EulerOS 2.0 SP2 : libidn (EulerOS-SA-2020-2358)
According to the version of the libidn package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Integer overflow in the decodedigit function in punydecode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibl...
Apache Shiro Privilege Bypass Vulnerability (CNVD-2020-60318)
Apache Shiro is a Java security framework that performs authentication, authorization, password and session management . Apache Shiro suffers from a privilege bypass vulnerability. A remote attacker could send specially crafted HTTP requests to bypass the authentication process and gain...
OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JNDI. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...
CVE-2020-7127
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...
The vulnerability of the Picketlink component of the JBoss Enterprise Application Platform allows a perpetrator to execute cross-site scripting attacks.
The vulnerability of the Picketlink component in the JBoss Enterprise Application Platform exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
SUSE-SU-2020:2968-1 Security update for taglib
This update for taglib fixes the following issues: - CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180...
Symphony CMS Cross-Site Scripting Vulnerability (CNVD-2020-63998)
Symphony CMS is a PHP + MySQL based , using XML and XSLT as the backbone of the open source content management system . A cross-site scripting vulnerability exists in Symphony CMS 3.0.0. A remote attacker can exploit this vulnerability by injecting arbitrary web script or HTML into the fields'bod...
pocsuite3
Based on the provided code and metadata, here is a compact paragraph of 5-7 sentences summarizing the analysis: pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the Knownsec 404 Team. It comes with a powerful proof-of-concept engine...