4750 matches found
ProjectSend cross-site scripting vulnerability (CNVD-2019-36883)
ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site scripting vulnerability exists in the 'Name' field of the My Account page in versions prior to ProjectSend r1053. The vulnerability stems from the WEB application's lack of proper...
Mozilla Firefox ESR Security Advisories (MFSA2019-09, MFSA2019-14) - Mac OS X
Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...
PT-2019-2368 · Cisco · Cisco Fx-Os +2
Name of the Vulnerable Software and Affected Versions: Cisco NX-OS versions prior to 8.31 Cisco FX-OS affected versions not specified Description: The issue is related to insufficient validation of arguments passed to certain CLI commands, which could allow an authenticated, local attacker with...
GHSA-8V67-X8Q5-3X3G Cross-Site Scripting in simditor
Versions of simditor prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with innerHTML, allowing attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 2.3.22 or later...
Gemalto Ezio Server Operating System Command Injection Vulnerability
Gemalto Ezio Server is an authentication server from Gemalto USA. An operating system command injection vulnerability exists in Gemalto Ezio Server versions prior to 3.1.0, which can be exploited by an attacker to execute illegal operating system commands...
Mozilla Firefox Input Validation Error Vulnerability
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An input validation error vulnerability exists in versions of Mozilla Firefox prior to 64, which arises from a network system or product that does not properly validate incoming data. An attacker could...
Google Chrome Autofill Information Disclosure Vulnerability (CNVD-2019-23114)
Google Chrome is the United States Google Google company's a Web browser. Autofill is one of the auto-fill form plug-ins. An information disclosure vulnerability exists in Autofill in versions of Google Chrome prior to 74.0.3729.108. An attacker can exploit this vulnerability to obtain user...
ALPINE-CVE-2019-10691
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username...
GitLab Authorization Issues Vulnerability
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab...
Oracle Berkeley DB Component Access Control Error Vulnerability
Oracle Berkeley DB is the United States Oracle Oracle, an open source embedded database programming libraries, it can be with C, C++, Java, Perl, Python, Tcl and many other languages for binding. data Store is one of the data storage components. A security vulnerability exists in the Data Store...
chromium-browser: Security UI spoofing
Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page...
CVE-2018-4275
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1...
Synology Router Manager Command Injection Vulnerability (CNVD-2019-08959)
Synology Router Manager SRM is a software for configuring and managing Synology routers from Synology Inc. of Taiwan, China. A command injection vulnerability exists in ftpd in Synology SRM versions prior to 1.1.7-6941-1. The vulnerability, which originates from a failure of a network system or...
Synology Drive Information Disclosure Vulnerability
Synology Drive is a collaborative office suite from Synology Taiwan, China. The product includes document management, collaborative office and file synchronization and backup features. An information disclosure vulnerability exists in SYNO.SynologyDrive.Files in Synology Drive versions prior to...
CVE-2019-10661
On Grandstream GXV3611IRHD before 1.0.3.23 devices, the root account lacks a password...
HP Support Assistant Authorization Issues Vulnerability
HP Support Assistant is a suite of solutions from Hewlett-Packard HP in the United States that provides support and other features for PCs and printers. A security vulnerability exists in HP Support Assistant versions prior to 8.7.50.3. A local attacker could exploit the vulnerability to execute...
Portainer has an unspecified vulnerability
Portainer is a lightweight user management interface for managing Docker environments and Docker hosts. A security vulnerability exists in Portainer versions prior to 1.20.0. An attacker can exploit the vulnerability to retrieve stored LDAP certificates...
PT-2019-19434 · Nagios · Nagios Xi +1
Name of the Vulnerable Software and Affected Versions: Nagios IM versions prior to 2.2.7 Description: The issue allows for authorization bypass in Nagios IM, a component of Nagios XI, enabling the closure of incidents via the API. Recommendations: For versions prior to 2.2.7, update to version...
DEBIAN-CVE-2019-3861
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory...