PYSEC-2021-48

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping...

CVE-2020-24719

Exposed Erlang Cookie could lead to Remote Command Execution RCE attack. Communication between Erlang nodes is done by exchanging a shared secret aka "magic cookie". There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlan...

CVE-2020-5352

Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulnerability to execute arbitrary commands on the affected system...

VMware ESXi Cross-Site Scripting Vulnerability

VMware ESXi is a server virtualization platform from VMware that can be installed directly on physical servers. A cross-site scripting vulnerability exists in VMware ESXi versions 6.5 and 6.7. An attacker can exploit this vulnerability to inject malicious scripts...

CVE-2020-1790

GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2020-02995)

Adobe Experience Manager is an enterprise content management solution that helps you simplify the management and delivery of your content and assets. A cross-site scripting vulnerability exists in Adobe Experience Manager 6.3, 6.4, and 6.5. An attacker can exploit this vulnerability to obtain...

IBM DB2 High Performance Unload load for LUW Code Issue Vulnerability

IBM DB2 is a relational database management system. The system is executed on UNIX, Linux, IBMi, z/OS, and Windows server versions.High Performance Unload load for LUW is a DB2 utility program. The program can be used to unload DB2 tables from a tablespace or image copy. A security vulnerability...

CVE-2019-8085

Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

CVE-2019-8083

Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CNVD-2019-36629)

Cisco Firepower Management Center is the nerve center for managing Cisco network security solutions, improving the effectiveness of Cisco network security solutions by providing centralized, integrated, and simplified management. A stored cross-site scripting vulnerability exists in the web-based...

CVE-2019-7964

Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability. Successful exploitation could lead to remote code execution...

STOPzilla AntiMalware Denial of Service Vulnerability (CNVD-2019-19487)

STOPzilla AntiMalware is a set of antivirus software from the American company STOPzilla that is mainly used for malware detection and killing. A denial of service vulnerability exists in the szkg64.sys driver file in STOPzilla AntiMalware version 6.5.2.59. The vulnerability originates from a...

STOPzilla AntiMalware Denial of Service Vulnerability (CNVD-2019-19488)

STOPzilla AntiMalware is a set of antivirus software from the American company STOPzilla that is mainly used for malware detection and killing. A denial of service vulnerability exists in the szkg64.sys driver file in STOPzilla AntiMalware version 6.5.2.59. The vulnerability originates from a...

CVE-2018-15816

FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d7d via a crafted image file...

Novell NetWare Stack Buffer Overflow Vulnerability

Novell NetWare is a network operating system developed by Novell. A stack buffer overflow vulnerability exists in the handling of the CALLIT RPC call in PKERNEL.NLM in versions of Novell NetWare prior to 6.5 SP8. A remote attacker could exploit this vulnerability to execute code...

Arcserve Unified Data Protection Information Disclosure Vulnerability (CNVD-2019-05544)

Arcserve Unified Data Protection UDP is a set of unified data protection solutions from Arcserve, Inc. in the United States. The solution provides backup and recovery of all virtual and physical environments, global deduplication, and more. An information disclosure vulnerability exists in the...

SQL Injection Vulnerability in Amoy AspCMS v6.5

Taote AspCMS is a set of ASP-based content management system developed by Taote.com on the basis of its own platform and with reference to the features of excellent CMS at home and abroad. SQL injection vulnerability exists in Taote AspCMS v6.5, which can be exploited by attackers to obtain...

Atlassian Confluence Cross-Site Scripting Vulnerability (CNVD-2018-00231)

Atlassian Confluence is a teamwork software written in Java and used primarily in enterprise environments. A cross-site scripting vulnerability exists in the RSS Feed macro in Atlassian Confluence before 6.5.2. A remote attacker can exploit this vulnerability to inject arbitrary HTML or JavaScrip...

Cicada Knowledge Enterprise Portal open source version 6.5 cross-site scripting vulnerabilities at the user login and backend logins

Cicada Knowledge Enterprise Portal System is an enterprise portal system designed for enterprise marketing use. Cicada Knowledge Enterprise Portal open source version 6.5 user login and background login at the cross-site scripting vulnerabilities, attackers can use the vulnerability to insert...

CVE-2016-9316

Multiple stored Cross-Site-Scripting XSS vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary...