Cross-Site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2020-28139)

The NETGEAR WAC505 and others are a wireless access point AP from NETGEAR. A cross-site request forgery vulnerability exists in multiple NETGEAR products, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can be exploited by an...

File Upload Vulnerability in Intimate Home Care Intimate Cat (imcat)

Intimate Cat imcat is a general-purpose website system designed in PHP+MySQL architecture. A file upload vulnerability exists in Intimate Cat imcat, which can be exploited by an attacker to upload a malicious file and then getshell it...

Croogo Cross-Site Scripting Vulnerability (CNVD-2020-33328)

Croogo is a content management system CMS based on the CakePHP framework development . The system provides content type can be customized for Blog, Node, Page, content editing using WYSIWYG editor and other features. A cross-site scripting vulnerability exists in versions prior to Croogo 3.0.7. T...

Cross-Site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2020-31321)

The NETGEAR R7500, among others, is a wireless router from NETGEAR. A cross-site request forgery vulnerability exists in a number of NETGEAR products. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can be exploite...

bitcoin-abe Cross-Site Scripting Vulnerability

bitcoin-abe is a blockchain browser. The product is able to read bitcoin block files and it supports converting and loading data into a database. A cross-site scripting vulnerability exists in the call in the abe.py file in bitcoin-abe versions 0.7.2 and earlier and 0.8pre and earlier. The...

CVE-2020-7083

An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application...

Denial Of Service (DoS)

WebKitGTK+ is vulnerable to denial of service DoS. Due use-after-free flaws found in WebKit, malicious web content causes an application using WebKitGTK+ to crash or, potentially, execute arbitrary code with the privileges of the user running the application...

Arbitrary Code Execution

freetype is vulnerable to arbitrary code execution. If a user loaded a carefully-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application...

Arbitrary Code Execution

libvorbis is vulnerable to arbitrary code execution. The vulnerability exists in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it w...

Castle Rock Computing SNMPc Online Cross-Site Request Forgery Vulnerability

Castle Rock Computing SNMPc Online is an advanced reporting plug-in for SNMPc Enterprise Network Manager from Castle Rock Computing, USA. A cross-site request forgery vulnerability exists in Castle Rock Computing SNMPc Online. The vulnerability stems from a WEB application that does not adequatel...

Plat'Home EasyBlocks IPv6 Cross-Site Request Forgery Vulnerability

Plat'Home EasyBlocks IPv6 is an IPv6 address set allocation unit product from Plat'Home Japan. A cross-site request forgery vulnerability exists in Plat'Home EasyBlocks IPv6 version 2.0.1 and earlier. The vulnerability stems from a WEB application that does not adequately verify that a request is...

WordPress WP Lead Plus X Cross-Site Scripting Vulnerability (CNVD-2020-22307)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.WP Lead Plus X is a page builder that supports building login and other pages. A cross-site scripting vulnerability exists i...

The vulnerability of the Redmine project and task management web application, related to the lack of protective measures for the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Redmine project and task management web application relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2020-11456

LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php aka survey groups...

CVE-2019-13307

A heap-based buffer overflow was discovered in ImageMagick in the way it parses images when using the evaluate-sequence option. Applications compiled against ImageMagick libraries that accept untrustworthy images and use the evaluate-sequence option or function EvaluateImages may be vulnerable to...

CVE-2019-9508

The CVE-2019-9508 vulnerability affects the Vertiv Avocent UMG-4000 web interface (version 4.2.1.19). It is a stored cross-site scripting (XSS) flaw arising because the web interface does not sanitize input, enabling an authenticated administrator to store a maliciously named file that executes w...

Sunnet eHRD Cross-Site Scripting Vulnerability

Sunnet eHRD is a talent management system from Sun Chat Technology Company in Taiwan, China. The system supports talent management and performance management, etc. A cross-site scripting vulnerability exists in Sunnet eHRD. The vulnerability stems from the lack of proper validation of client-side...

UliCMS Cross-Site Scripting Vulnerability

UliCMS is an open source content management system. UliCMS suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Canon Oce Colorwave 500 cross-site scripting vulnerability (CNVD-2020-18988)

The Canon Oce Colorwave 500 is a printer from Canon Japan. A cross-site scripting vulnerability exists in the 'settingId' parameter of the settingDialogContent.jsp page of the web application in Canon Oce Colorwave 500 version 4.0.0.0. The vulnerability stems from a lack of proper validation of...

Canon Oce Colorwave 500 CSRF Vulnerability

The Canon Oce Colorwave 500 is a printer from Canon Japan. A security vulnerability exists in the web application in Canon Oce Colorwave 500 version 4.0.0.0, which stems from the program not having any form of cross-site request forgery protection. An attacker could exploit the vulnerability to...