CVE-2020-4302

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID:...

The vulnerability of the JunOS operating system, related to synchronization errors when using shared resources, allows a hacker to alter the device’s configuration.

The vulnerability of the JunOS operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to modify the device’s configuration...

CVE-2020-25601

An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchnreset / evtchndestroy. In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these when resetting all event channels or when cleaning...

The vulnerability of the PAN-OS operating system, related to copying buffers without checking the size of the input data, allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the PAN-OS operating system lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

Command Execution Vulnerability in Smart-MDS Multimedia Command and Dispatch System of Dixin Technology (CNVD-2020-60313)

But the new technology Smart-MDS multimedia command and scheduling system with convergence access function, provide multi-service convergence of the unified scheduling management platform, access to mainstream various types of audio and video communication system functions. Smart-MDS Multimedia...

GHSA-V86X-F47Q-F7F4 Unauthorized File Access in atompm

Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later...

Remote code execution

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface GDI handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or dele...

Microsoft Windows/Windows Server Information Disclosure Vulnerability (CNVD-2021-63327)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, an operating system for personal devices, and Microsoft Windows Server, a server operating system. Microsoft Windows/Windows Server is vulnerable to an information disclosure vulnerability that originates...

CVE-2020-2037

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1...

WMCMS open source novel system V4.367.977 exists arbitrary file reading vulnerability

WMCMS is based on PHP + MYSQL as the core development, free + open source professional Chinese labeling system. WMCMS open source novel system V4.367.977 arbitrary file reading vulnerability , attackers can use the vulnerability to obtain sensitive information...

SQL Injection Vulnerability in BaiLian Mall System

BaiLian mall system is a set of computer version of the mall + mobile version of the website + micro mall enterprise wechat public number secondary development + palm sales through the mobile mall + BaiLian bearing network www.bearing.cn the whole network of promotion and publicity in one of the...

CVE-2020-25043

The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the system...

Command Injection in tomato

All versions of tomato are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

Anhui Hope Network Technology Co., Ltd. website building system suffers from SQL injection vulnerabilities (CNVD-2020-48244)

Anhui Hope Network Technology Co., Ltd. is an Internet basic product service provider mainly engaged in website construction, network promotion and network marketing. Anhui Hope Network Technology Co., Ltd. website building system has SQL injection vulnerability, attackers can use the vulnerabili...

Palo Alto Networks PAN-OS Input Validation Error Vulnerability (CNVD-2020-49272)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. An input validation error vulnerability exists in Palo Alto Networks PAN-OS. The vulnerability arises from a network system or product that does not properly validate incoming data. An...

Memory corruption

IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

Memory corruption

IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

CVE-2020-14344

A flaw was found in libX11. An integer overflow leading to a heap-buffer overflow occurs when setuid programs call XIM client functions while running with elevated privileges. The highest threat from this vulnerability are to data confidentiality and integrity as well as system vulnerability...

Sick Package Analytics Password Management Vulnerability

Sick Package Analytics is a system performance monitoring software for automatic identification systems from Sick. A security vulnerability exists in Sick Package Analytics V04.1.1 and prior versions, which originates from the program storing passwords in plaintext. An attacker could exploit the...

Shanghai Danfan Network Technology Co., Ltd. builds website system with SQL injection vulnerability (CNVD-2020-48959)

Huaxia chemical network was founded in 2000, is founded by Shanghai Danfan network technology limited company, for the chemical industry to provide supporting B2B e-commerce platform of professional website. Shanghai Danfan network science and technology limited company builds the station system...