CVE-2021-1172

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper...

CVE-2021-1197 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper...

CVE-2021-1210 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. The vulnerabilities are due to improper...

Missing user validation leading to information disclosure

Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data directory in the web root...

Esri Arcgis Server 代码问题漏洞

Esri Arcgis Server is the United States Esri company's a Web-oriented can be used to provide geographic location services, enterprise-class software platform. A security vulnerability exists in Esri ArcGIS Server versions prior to 10.8, which stems from a configuration that does not adequately...

CVE-2020-7754

CVE-2020-7754 affects npm-user-validate before 1.0.1. The vulnerability is a ReDoS in the email validation regex, where input strings starting with @ can cause exponential processing time, potentially leading to denial of service. Multiple connected advisories (e.g., MiracleLinux AXSA entries) re...

Design/Logic Flaw

Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users...

McAfee Data Loss Prevention ePO extension Cross-Site Request Forgery Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from McAfee, Inc. that prevents theft and accidental disclosure of confidential data and provides security policies for file processing and transmission, shared data flow control and data encryption. The...

PT-2020-6262 · Snmptt +2 · Snmptt +2

Name of the Vulnerable Software and Affected Versions: SNMPTT versions prior to 1.4.2 Description: The issue is related to incorrect remote user validation in the SNMPTT SNMP-trap handler. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity...

CVE-2020-3377 Cisco Data Center Network Manager Command Injection Vulnerability

A vulnerability in the Device Manager application of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to inject arbitrary commands on the affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this...

CVE-2020-14983

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled numplayers value, leading to a buffer overflow. A malicious user can overwrite the server's stack...

CVE-2020-3214

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to escalate their privileges to a user with root-level privileges. The vulnerability is due to insufficient validation of user-supplied content. This vulnerability could allow an attacker to load malicious...

CVE-2019-14078

Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and...

Security Updates for Microsoft Dynamics NAV (Dec 2018)

The Microsoft Dynamics NAV install is missing a security update. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, by sending a specially crafte...

Cross-Site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2020-28139)

The NETGEAR WAC505 and others are a wireless access point AP from NETGEAR. A cross-site request forgery vulnerability exists in multiple NETGEAR products, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can be exploited by an...

Out-of-bounds

Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially crafted, malicious input file due to the lack of validation...

Improper access control

GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. This issue exists because of an incomplete fix for CVE-2015-2680, in which "token" is used as a CSRF protection mechanism, but without validation that "token" is associated with an administrative user...

TopManage OLK Cross-Site Request Forgery Vulnerability

TopManage OLK is a suite of e-commerce management solutions from TopManage Panama. A cross-site request forgery vulnerability exists in TopManage OLK version 2020. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An...

WordPress marketo-forms-and-tracking cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. A cross-site request forgery vulnerability exists in wp-admin/admin.php?page=marketofat in WordPress marketo-forms-and-tracking plugin 1.0.2 and prior versions. The vulnerability stems from...

WordPress 5.3.x < 5.3.1 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Two cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, by convincing ...