4889 matches found
wolfSSL buffer overflow vulnerability (CNVD-2020-13495)
wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in wolfSSL CyaSSL versions prior to 2.9.4. The vulnerability stems from a networked system or...
CVE-2020-9342
The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.605.474 on Linux of Cloud Protection For Salesforce, Email and Server Security, and Internet GateKeeper...
PrestaShop Cross-Site Scripting Vulnerability (CNVD-2020-13058)
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop versions prior to 1.4.11. T...
CVE-2020-8960: Improper Neutralization of Input During Web Page Generation
Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS...
PT-2020-10464
Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.1 Description A flaw exists in the handling of URLs with a slash and backslash at the beginning, leading to an open redirect issue. Recommendations For versions prior to 2.4.1, update to version 2.4.1 or...
Promise-probe Command Injection Vulnerability
Promise-probe is a probe module. A command injection vulnerability exists in promise-probe versions prior to 0.10.0. The vulnerability stems from a network system or product not properly filtering specific elements of externally entered data during the construction of executable commands. An...
DEBIAN-CVE-2012-6685
Nokogiri before 1.5.4 is vulnerable to XXE attacks...
CVE-2020-8427
In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass...
DEBIAN-CVE-2014-6262
Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted third argument to the rrdtool.graph function, aka ZEN-15415...
PT-2020-20264
Name of the Vulnerable Software and Affected Versions: InfiniteWP Client plugin versions prior to 1.9.4.5 Description: The InfiniteWP Client plugin for WordPress has a missing authorization check in the iwp mmb set request function within the init.php file. An attacker who knows an administrator'...
AZL-35332 CVE-2014-8140 affecting package unzip for versions less than 6.0-20
Heap-based buffer overflow in the testcompreb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...
CVE-2020-7911
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS...
DEBIAN-CVE-2020-5225
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances,...
CVE-2016-1000237
sanitize-html before 1.4.3 has XSS...
CVE-2020-5217
In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a semicolon could be injected leading to directive injection. This could be us...
CVE-2019-6858
A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator Software Version prior to V1.0.8.1, which could cause privilege escalation when injecting a malicious DLL...
Unspecified Vulnerability in SchedMD Slurm (CNVD-2020-10640)
SchedMD Slurm is SchedMD's open source and highly scalable cluster management and job scheduling system for large and small Linux clusters. A security vulnerability exists in SchedMD Slurm versions prior to 18.08.9 and 19.x versions prior to 19.05.5. No detailed vulnerability details are availabl...
PYSEC-2020-83
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow...
Cisco Data Center Network Manager Authentication Bypass Vulnerability
Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. An authentication bypass vulnerability exists in the Web management interface of...