chromium-browser: Use after free in audio

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Stack overflow

Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially...

http4s path traversal vulnerability

http4s is an open source for Scala streaming HTTP server . A path traversal vulnerability exists in FileService, ResourceService, and WebjarService in http4s versions prior to 0.18.26, 0.20.20, and 0.21.2, which stems from the program's failure to properly normalize URLs. An attacker can exploit...

CVE-2020-9423

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

Yubico YubiKey Validation Server SQL Injection Vulnerability

Yubico YubiKey Validation Server is an authentication server from the Swedish company Yubico. A SQL injection vulnerability exists in YubiKey Validation Server versions prior to 2.40. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...

Bodymen Access Control Error Vulnerability

bodymen is a body parser middleware for MongoDB, Express and Nodejs MEN. A security vulnerability exists in bodymen versions prior to 1.1.1. An attacker can exploit the vulnerability to add or modify Object.prototype properties with the help of the 'handler' parameter...

CVE-2020-8953

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

Code injection

When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon JDHCPD process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may remotely take over the code execution of the JDHDCP process. This iss...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2020-02975)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 72, which stems from the program not applying content security policies to the XSL stylesheets of XML documents. An attacker could us...

SmokePing Cross-Site Scripting Vulnerability

SmokePing is a network monitoring software developed by Tobias Oetiker, a Swiss software developer. The program's function is to monitor network performance, including monitoring www server performance, monitoring DNS query performance, monitoring SSH performance and so on. A cross-site scripting...

serialize-to-js cross-site scripting vulnerability

serialize-to-js is a package that serializes objects to strings. A cross-site scripting vulnerability exists in serialize-to-js NPM versions prior to 3.0.1. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

Intel Graphics Driver Code Issue Vulnerability

Intel Graphics Driver is the Intel graphics card driver. A pointer corruption vulnerability exists in the Unified Shader Compiler in versions prior to Intel Graphics Driver 10.18.14.5074. An attacker could exploit this vulnerability to achieve elevation of privilege...

Linux kernel input validation error vulnerability (CNVD-2019-47001)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 2.6.33. An attacker could exploit this vulnerability to cause a kernel exception...

pfSense freeradius3 package cross-site scripting vulnerability

pfSense is a network firewall based on FreeBSD Linux. freeradius3 package is a Remote User Dial-In Authentication Service RADIUS package used in it. A cross-site scripting vulnerability exists in the /usr/local/www/freeradiusviewconfig.php file in versions of pfSense freeradius3 package prior to...

Google Chrome Security Updates (stable-channel-update-for-desktop_31-2019-10) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Red Hat XML Language Support XML Language Server Path Traversal Vulnerability

Red Hat XML Language Support vscode-xml is the United States Red Hat Red Hat a support for the creation and editing of XML documents Visual Studio Code extensions. XML Language Server is used in one of the XML language server. A path traversal vulnerability exists in the XMLLanguageService.java...

ncurses buffer overflow vulnerability (CNVD-2020-13676)

ncurses is a character terminal processing library , it can provide a series of functions for the user to call and generate text-based user interface . A buffer overflow vulnerability exists in the 'ncfindentry' function in the tinfo/comphash.c file of the terminfo library in versions prior to...

CVE-2019-17133

In the Linux kernel through 5.3.2, cfg80211mgdwextgiwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow...

WordPress api-bearer-auth plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. api-bearer-auth is used in one of the REST API authentication plugin. A cross-site scripting vulnerability exists in versions of t...

Siemens SIMATIC TDC CP51M1 Input Validation Error Vulnerability

The Siemens SIMATIC TDC CP51M1 is an industrial Ethernet communication module for the SIMATIC TDC automation system from Siemens, Germany. An input validation error vulnerability exists in Siemens SIMATIC TDC CP51M1 versions prior to 1.1.7. An attacker could exploit this vulnerability by sending...