CVE-2019-5232: Use of Insufficiently Random Values

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak...

CVE-2016-4980: Use of Insufficiently Random Values

A password generation weakness exists in xquest through 2016-06-13...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...

CVE-2012-6078

W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes...

DEBIAN-CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

UBUNTU-CVE-2019-19039

btrfsfreeextent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfsprintleaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as no...

Huawei VP9630, VP9650 and VP9660 Use of Insufficient Random Values Vulnerability

Huawei VP9630 is a multimedia switching device mainly used for video conferencing from Huawei, China. A security vulnerability exists in the Huawei VP9630, VP9650, and VP9660. A remote attacker could exploit the vulnerability to obtain information...

Linux kernel information disclosure vulnerability (CNVD-2019-42534)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. An information disclosure vulnerability exists in Linux kernel 5.3.12 and earlier versions. The vulnerability stems...

CVE-2019-6187

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller XCC that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV...

PT-2019-4420

Name of the Vulnerable Software and Affected Versions Huawei ViewPoint versions 9630, 9650, 9660 Description The issue is related to the use of insufficiently random values, allowing an unauthenticated, remote attacker to guess information through a large number of attempts. Successful exploitati...

Security Advisory - Use of Insufficiently Random Values Vulnerability in Huawei ViewPoint Products

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large number of attempts. Successful exploitation may cause information leak. Vulnerability ID: HWPSIRT-2019-10076 This vulnerability has been...

PT-2019-4253

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.3.12 Description The issue in the Linux kernel's btrfs free extent function allows local users to obtain potentially sensitive information about register values via the dmesg program in a certain ENOENT case. Th...

WS-2019-0584

In yara, v3.6.0 to v3.11.0 may read uninitialized values which results in process crash...

Information Disclosure

apache arrow is vulnerable to information disclosure. In certain cases, arrays with null values could be built using uninitialized memory for their data segment, resulting in unintentional memory being shared over the wire...

IBM UrbanCode Deploy File Download Vulnerability

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

Code injection

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript:alert substring...

CVE-2019-18857

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring...

CVE-2019-18857

The CVE refers to darylldoyle svg-sanitizer before 0.12.0, where the parser mishandles script and data values in attributes, evidenced by unusual whitespace such as javascript :alert. This vulnerability is documented across multiple feeds (NVD, Red Hat, GHSA, OSV, etc.) and is associated with cro...

CVE-2019-18857: Improper Neutralization of Input During Web Page Generation

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring...

CSV Injection on node label

Summary CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. An authenticated malicious user can insert a crafted formula in the node label that can be later executed on another system after another user has downloaded and opened the node li...