4610 matches found
CVE-2019-17406
Nokia IMPACT 18A has path traversal that may lead to RCE if chained with CVE-2019-1743...
DEBIAN-CVE-2019-13682
Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page...
matomo cross-site scripting vulnerability (CNVD-2019-42239)
matomo is an open source web analytics application based on PHP and MySQL. A cross-site scripting vulnerability exists in matomo versions prior to 1.10.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerabilit...
Cisco Email Security Appliance AsyncOS Software Input Validation Error Vulnerability
Cisco Email Security Appliance ESA is an email security appliance from Cisco in the U.S. AsyncOS Software is the operating system that runs on it. An input validation error vulnerability exists in the MP3 detection engine of AsyncOS Software prior to version 13.0 in the Cisco ESA, which stems fro...
Linux kernel resource management error vulnerability (CNVD-2019-41719)
Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A resource management error vulnerability exists in the 'adisupdatescanmodeburst' function in the drivers/iio/imu/adisbuffer.c file in versions of Linux kernel prior t...
DEBIAN-CVE-2014-0021
Chrony before 1.29.1 has traffic amplification in cmdmon protocol...
DEBIAN-CVE-2019-18978
An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...
CVE-2019-12720
AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvcsendmail.aspx MailAdd parameter SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picturemanagemvc.aspx plantno parameter, the...
DEBIAN-CVE-2019-18848
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...
dtc-xen competitive conditions issue vulnerability
dtc-xen is a SOAP daemon primarily used for control panel management of Xen VMs. A contention condition issue vulnerability exists in version 0.5.x prior to dtc-xen 0.5.4. The vulnerability stems from mishandling of concurrent access when concurrent code is required to access shared resources...
Broadcom Brocade SANnav Trust Management Issue Vulnerability
Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A trust management issue vulnerability exists in the ReportsTrustManager class in Broadcom Brocade SANnav versions prior to 2.0. The vulnerability stems from the lack of an effective trust management mechanism in th...
Stored XSS in field name data model
Summary An attacker with admin access to the appliance can inject malicious code that will later be executed by another legitimate users. This allows an attacker to perform unauthorized actions on behalf of legitimate users. JavaScript injection was possible using the field name when adding new...
tnef buffer overflow vulnerability (CNVD-2020-44298)
tnef is a program for decompressing files in the TNEF Transport Neutral Encapsulation Format format. A buffer overflow vulnerability exists in versions of tnef prior to 1.4.18. The vulnerability stems from a networked system or product performing operations in memory without properly validating...
Cryptocat Input Validation Error Vulnerability
Cryptocat is an open source online cryptographic chat application. A security vulnerability exists in Cryptocat versions prior to 2.0.22. An attacker can exploit this vulnerability to cause a denial of service with a username...
CVE-2009-5050
konversation before 1.2.3 allows attackers to cause a denial of service...
CVE-2019-1877
A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sessions. The vulnerability is due to insufficient authentication mechanisms on the file download function of the API. An attacker could explo...
One Identity Cloud Access Manager Cross-Site Request Forgery Vulnerability
One Identity Cloud Access Manager CAM is a Web-based access management solution from US-based One Identity. The product supports single sign-on, multi-factor authentication, access control and auditing. A cross-site request forgery vulnerability exists in One Identity CAM versions prior to 8.1.4...
PYSEC-2019-175
An eval vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests...