Microsoft Exchange Server Denial of Service Vulnerability

Microsoft Exchange Server is a suite of e-mail service programs. A denial-of-service vulnerability exists in Microsoft Exchange Server, which allows remote attackers to exploit the vulnerability by submitting a special e-mail request that can be tricked into being parsed by the user, which can...

Siemens IE/WSN-PA Link WirelessHART Gateway Cross-Site Scripting Vulnerability

The IE/WSN-PA Link is a gateway that connects the WirelessHART network to Industrial Ethernet. A cross-site scripting vulnerability exists in the Siemens IE/WSN-PA Link WirelessHART Gateway. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

WordPress democracy-poll plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. democracy-poll is an online poll plugin used in it. A cross-site request forgery vulnerability exists in the WordPress democracy-poll...

NETGEAR Nighthawk M1 Cross-Site Request Forgery Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a...

NETGEAR EX7000 Cross-Site Scripting Vulnerability

The NETGEAR EX7000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in NETGEAR EX7000 version V1.0.0.421.0.94. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execute...

Crunchbase Cognitoys Dino Cross-Site Request Forgery Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site request forgery vulnerability exists in the Crunchbase Cognitoys Dino device. The vulnerability stems from the WEB application not adequately verifying that a request is from a trusted...

Bagisto Cross-Site Request Forgery Vulnerability

Bagisto is a set of open source e-commerce framework. A cross-site request forgery vulnerability exists in Bagisto version 0.1.5, which stems from a WEB application that does not adequately validate whether a request comes from a trusted user, and can be exploited by an attacker to send an...

SQL Injection Vulnerability in ASK2 Q&A System Ap***.php File

ASK2 Q&A is an open source PHP Q&A program. ASK2 Q&A System Ap.php file has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

The vulnerability of the Common Desktop Environment component in Oracle Solaris allows a hacker to gain full control over the application.

The vulnerability of the Common Desktop Environment component in Oracle Solaris systems is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2019-11200

Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. Malicious binaries can be...

The vulnerability of the Win32k component of the Windows operating system, which allows a hacker to execute arbitrary code in kernel mode

The vulnerability of the Win32k component of the Windows operating system is related to errors in memory object handling. Exploiting this vulnerability allows an attacker to execute arbitrary code in kernel mode using a specially created application...

CVE-2019-13626

An out-of-bounds read flaw was discovered in SDL2, in the way that WAVE files are loaded through the SDLLoadWAVRW function. An application that uses SDL2 and loads untrusted input files may be vulnerable to this flaw. An attacker can abuse this flaw to crash the application or to leak data from t...

CVE-2019-13299

A heap-based buffer over-read was discovered in ImageMagick in the way it applies a value with arithmetic, relational, or logical operators to an image in GetPixelChannel. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An...

CVE-2019-13302

A heap-based buffer over-read was discovered in ImageMagick in the way it performs complex mathematics on an image sequence. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a...

DIGISOL SYSTEMS DG-HR3400 Cross-Site Scripting Vulnerability

DIGISOL SYSTEMS DG-HR3400 is a wireless router from DIGISOL SYSTEMS India. A cross-site scripting vulnerability exists in the DIGISOL SYSTEMS DG-HR3400. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to...

Cross-site scripting vulnerability in multiple Zyxel devices

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. Zyxel ZyWall A cross-site...

Shanghai New Win-Win Information Technology Co., Ltd Au Bump Rental Car APP has Denial of Service Vulnerability

Au Rent a Car AP is a taxi and car rental software for life travel. Shanghai New Win-Win Information Technology Company Limited Au Bump Rent A Car AP suffers from a denial-of-service vulnerability, which can be exploited by an attacker to cause the application to crash by sending null, anomalous,...

Quadbase Systems EspressReport ES Cross-Site Scripting Vulnerability

Quadbase Systems EspressReport ES ERES is a centralized business intelligence reporting solution from Quadbase Systems, USA. A cross-site scripting vulnerability exists in Quadbase Systems ERES version 7.0 update 7. The vulnerability stems from a lack of proper validation of client-side data by t...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16939)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...