CVE-2020-11980

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...

Privilege escalation

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role c...

CVE-2020-11980

CVE-2020-11980 affects Apache Karaf JMX where JAAS-based authentication and ACL-based authorization allow a non-admin with a viewer role to call get* via etc/jmx.acl.cfg, potentially triggering getMBeansFromURL to fetch MBeans remotely and register them, enabling SSRF-like behavior and MBean regi...

IrfanView has an unspecified vulnerability (CNVD-2021-24896)

IrfanView is an image viewer that supports image browsing, image editing, image format conversion and more. A security vulnerability exists in IrfanView version 4.54. No details of the vulnerability are provided at this time...

Unspecified Vulnerability in IrfanView

IrfanView is an image viewer that supports image browsing, image editing, image format conversion and more. A security vulnerability exists in IrfanView version 4.54. No details of the vulnerability are provided at this time...

DLL Hijacking Vulnerability in Golden Ark Chart Viewer

Golden Boat Viewing King is a viewing software of Jiangxia Information Technology Huizhou Co. There is a DLL hijacking vulnerability that can be exploited by attackers to execute arbitrary code...

CVE-2019-16385

Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a...

CVE-2019-16385

Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a...

Cross site scripting

Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a...

CVE-2019-16385

Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF, containing the malicious payload. This results in a...

CVE-2019-16385

Cybele Thinfinity VirtualUI 2.5.17.2 is affected by CVE-2019-16385 due to an HTTP response splitting flaw via the mimetype parameter in a PDF viewer request, enabling a reflected XSS when a user loads a malicious PDF request (example.pdf?mimetype=...). Red Hat advisory RH:CVE-2019-16385 corrobora...

Extreme Viewer suffers from buffer overflow vulnerability

Extreme Viewer is a fast viewing software, compatible with all major image formats, and also supports raw, psd, cr2 and so on. Ltd. Extreme Viewer has a buffer overflow vulnerability, an attacker can cause the software to crash through the poc, the successful exploitation of this vulnerability ca...

Buffer Overflow Vulnerability (CNVD-2020-40769) in Extreme Viewer of Malpais (Shanghai) Software Technology Co.

Extreme Viewer is a fast viewing software, compatible with all major image formats, and also supports raw, psd, cr2 and so on. Ltd. Extreme Viewer has a buffer overflow vulnerability, an attacker can cause the software to crash through the poc, the successful exploitation of this vulnerability ca...

Mobotix (Shanghai) Software Technology Co., Ltd. is vulnerable to double free vulnerability

Extreme Viewer is a fast viewing software, compatible with all major image formats, and also supports raw, psd, cr2 and so on. Ltd., there is a double free vulnerability, the attacker through the poc can cause the software to crash, the successful exploitation of this vulnerability can lead to...

The vulnerability of the multimedia content viewing function in Cisco WebEx Meetings Server’s software for web conferencing allows a intruder to gain unauthorized access to protected information.

The vulnerability of the multimedia content viewing function in Cisco WebEx Meetings Server software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information from a remote location...

Extreme View has a buffer overflow vulnerability

Extreme Viewer is a picture viewing software developed by Malpais Shanghai Software Technology Co. A buffer overflow vulnerability exists, which can be exploited to cause a denial of service...

Extreme Viewing suffers from a buffer overflow vulnerability (CNVD-2020-38489)

Extreme Viewer is a picture viewing software developed by Malpais Shanghai Software Technology Co. A buffer overflow vulnerability exists, which can be exploited to cause a denial of service...

Extreme Viewing suffers from a buffer overflow vulnerability (CNVD-2020-38488)

Extreme Viewer is a picture viewing software developed by Malpais Shanghai Software Technology Co. A buffer overflow vulnerability exists, which can be exploited to cause a denial of service...

Extreme Viewing suffers from a buffer overflow vulnerability (CNVD-2020-38485)

Extreme Viewer is a picture viewing software developed by Malpais Shanghai Software Technology Co. A buffer overflow vulnerability exists, which can be exploited to cause a denial of service...

[SECURITY] [DLA 2219-1] feh security update

Package : feh Version : 2.12-1+deb8u1 CVE ID : CVE-2017-7875 Tobias Stoeckmann discovered that it was possible to trigger an out-of-boundary heap write with the image viewer feh while receiving an IPC message. For Debian 8 "Jessie", this problem has been fixed in version 2.12-1+deb8u1. We recomme...