1136 matches found
Extreme Viewing suffers from a heap overflow vulnerability (CNVD-2020-33238)
Extreme Viewer is the current ultra-fast and ultra-high-definition viewing software, compatible with all mainstream image formats and professional image formats. A heap overflow vulnerability exists, which can be exploited by an attacker to cause the software to crash...
Extreme Viewing suffers from a heap overflow vulnerability (CNVD-2020-33236)
Extreme Viewer is the current ultra-fast and ultra-high-definition viewing software, compatible with all mainstream image formats and professional image formats. A heap overflow vulnerability exists, which can be exploited by an attacker to cause the software to crash...
PT-2020-13386 · Cacti +3 · Cacti +3
Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.11 Description: The issue arises when a user account is disabled in Cacti, but the permissions granted to that account are not immediately invalidated. This means that the disabled account may still have access to...
Horde Groupware Webmail Cross-Site Scripting Vulnerability (CNVD-2020-33657)
Horde Groupware Webmail is a browser-based, enterprise-class communications suite from Horde, Inc. A cross-site scripting vulnerability exists in the image viewing feature in Horde Groupware Webmail Edition prior to 5.2.22, which can be exploited to gain access to a user's Webmail account via a...
WordPress 4.4.x < 4.4.22 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...
The vulnerability of the local_graph_id function in the Cacti server monitoring system allows unauthorized access by bypassing authentication using a user-controlled key. This enables attackers to gain access to confidential data.
The vulnerability of the localgraphid function in the Cacti server monitoring system is related to an authentication check error for viewing graphs. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data...
The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, Adobe Acrobat 2015, Adobe Acrobat Reader 2015 are related to the lack of measures for cleaning incoming data. This vulnerability allows attackers to disclose protected information.
The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to the lack of measures for cleaning incoming data. Exploiting these vulnerabilities...
The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to an operation that goes beyond the buffer in memory, allowing attackers to execute arbitrary code.
The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability cou...
Starbucks: Thailand - IDOR on www.starbuckscardth.in.th: A logged in user could view any Thailand Starbucks card balance if they knew that Starbucks card number
nnez discovered that after a successful card balance transfer between two of their own registered Thailand Starbucks cards, they could update the 2nd card number URL parameter to another known Thailand Starbucks card number and view that 2nd card balance. @nnez — thank you for reporting this...
Improper access control
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view restricted sensitive information...
Unauthorized Access Vulnerability in Website Building System of Qinhuangdao Shangjing Technology Co. Ltd (CNVD-2020-24435)
Qinhuangdao Shangjing Technology Co., Ltd. is a high-tech enterprise. Qinhuangdao Shangjing Technology Co., Ltd. building system has an unauthorized access vulnerability, which can be exploited by an attacker to view and change the administrator's password access...
CVE-2019-20559
An issue was discovered on Samsung mobile devices with P9.0 software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 October 2019...
Design/Logic Flaw
An issue was discovered on Samsung mobile devices with P9.0 software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 October 2019...
CVE-2019-20559
An issue was discovered on Samsung mobile devices with P9.0 software. Gallery allows viewing of photos on the lock screen. The Samsung ID is SVE-2019-15055 October 2019...
Alfresco 5.2.4 Cross Site Scripting
Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting Date: 2020-03-02 Exploit Author: Romain LOISEL & Alexandre ZANNI https://pwn.by/noraj - Pentesters from Orange Cyberdefense France Vendor Homepage: https://www.alfresco.com/ Software Link: https://www.alfresco.com/ecm-software Versio...
Alfresco 5.2.4 - Persistent Cross-Site Scripting
Alfresco 5.2.4 - Persistent Cross-Site Scripting Exploit Title: Alfresco 5.2.4 - Persistent Cross-Site Scripting Date: 2020-03-02 Exploit Author: Romain LOISEL & Alexandre ZANNI https://pwn.by/noraj - Pentesters from Orange Cyberdefense France Vendor Homepage: https://www.alfresco.com/ Software...
Microsoft Windows Modules Installer Servic Information Disclosure Vulnerability
Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An information disclosure vulnerability exists in the Microsoft Windows Modules Installer Service. An attacker could exploit this vulnerability to view any file on the file system with...
CloudBees Jenkins Dynamic Extended Choice Parameter plugin memory corruption vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A memory corruption vulnerability exists in CloudBees Jenkins Dynamic Extended Choice Parameter Plugin, which can be exploited by an attacker to read the privileg...
Authentication flaw
ilbo App ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01 allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors...
