Linux kernel input validation error vulnerability (CNVD-2019-38522)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. An input validation error vulnerability exists in the 'setgeometry' function of the drivers/block/floppy.c file in versions of Linux kernel prior to 5.2.3. The...

CVE-2019-14415

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. A persistent cross-site scripting XSS vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that a...

Openbravo ERP Directory Traversal Vulnerability

Openbravo ERP is a web-based enterprise resource planning ERP solution. A path traversal vulnerability exists in Openbravo ERP versions prior to 3.0PR19Q1.3. The vulnerability stems from the failure of a networked system or product to properly filter special elements in the path of a resource or...

CVE-2019-14328

The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section...

UBUNTU-CVE-2019-11700

A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. Note: this issue only occurs on Windows. Other operating systems are unaffected.. This vulnerability affects Firefox 67...

Oracle VM VirtualBox Component Access Control Error Vulnerability (CNVD-2019-27304)

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Hyland Software Perceptive Content Server Denial of Service Vulnerability

Hyland Software Perceptive Content Server is a suite of content and process management solutions from Hyland Software, USA. The product includes features such as document management, electronic signatures, records and information management.ImageNow Server is one of the ImageNow servers. A denial...

Linaro OP-TEE Buffer Overflow Vulnerability (CNVD-2019-22865)

Linaro OP-TEE is an open source trusted execution environment from Linaro UK. A buffer overflow vulnerability exists in opteeos in Linaro OP-TEE 3.3.0 and earlier versions. The vulnerability stems from a networked system or product performing operations on memory without properly validating data...

PT-2019-13433 · Foliovision · Fv Flowplayer Video Player

Name of the Vulnerable Software and Affected Versions: FolioVision FV Flowplayer Video Player plugin versions prior to 7.3.19.727 Description: A SQL injection issue exists, allowing a remote attacker to execute arbitrary SQL commands on the affected system. Recommendations: For versions prior to...

EdgeMAX EdgeSwitch Command Injection Vulnerability

Ubiquiti Networks EdgeMAX EdgeSwitch is a PoE+ Gigabit switch from Ubiquiti Networks, Inc. A command injection vulnerability exists in Ubiquiti Networks EdgeMAX EdgeSwitch versions prior to 1.8.2. The vulnerability stems from a network system or product not properly filtering specific elements of...

CVE-2019-5446

Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root...

JetBrains YouTrack Confluence Plugin Code Execution Vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A code execution vulnerability exists in the JetBrains YouTrack Confluence plugin versions...

Unspecified Vulnerability in Magento (CNVD-2020-52445)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A security vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerce versions...

PT-2019-11617 · Yard +3 · Yard +3

Name of the Vulnerable Software and Affected Versions: yard versions prior to 0.9.20 Description: A path traversal issue was discovered in yard when using yard server to serve documentation, allowing unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under...

PT-2019-11592 · Red Hat +1 · Spacewalk +1

Name of the Vulnerable Software and Affected Versions: Spacewalk versions prior to 2.10 Description: The issue arises from the unsafe computation of client token checksums. An attacker with a valid but expired authenticated set of headers could manipulate the session validity without altering the...

Synology Note Station Cross-Site Scripting Vulnerability (CNVD-2019-20979)

Synology Note Station is a cloud-based note management application from Synology Inc. of Taiwan, China. A cross-site scripting vulnerability exists in SYNO.NoteStation.Shard in Synology Note Station versions prior to 2.5.3-0863. The vulnerability stems from the WEB application lacking proper...

Google Chrome Fake Address Bar Content Vulnerability

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 68.0.3440.75, which stems from the program failing to adequately validate data. A remote attacker can exploit the vulnerability to spoof the contents of the Omnibox...

Magento cross-site scripting vulnerability (CNVD-2019-26223)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions . A cross-site scripting vulnerability exists in Magento Open Source versions prior to 1.9.4.2 and Magento Commerc...

UBUNTU-CVE-2018-6145

Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page...

Intel Chipset Device Software Elevation of Privilege Vulnerability

Intel Chipset Device Software is a chipset firmware update utility from Intel Corporation USA. A security vulnerability exists in the installer in Intel Chipset Device Software INF Update Utility versions prior to 10.1.1.45. A local attacker can exploit the vulnerability to elevate privileges...