Libav Buffer Overflow Vulnerability (CNVD-2019-35787)

Libav is Libav team's set of cross-platform audio and video can be recorded, converted solution, which includes a libavcodec encoder. A buffer overflow vulnerability exists in the subtitle decoder in Libav version 12.3, which can be exploited by an attacker to cause, among other things, a buffer...

WordPress wps-hide-login plugin security bypass vulnerability (CNVD-2019-30732)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wps-hide-login is a hide-login plugin that is used in it. A security vulnerability exists in WordPress wps-hide-login plugi...

Google Android Media Framework Denial of Service Vulnerability (CNVD-2019-40055)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Media Framework is one of the multimedia development frameworks. A denial of service vulnerability exists in Media framework in Android. An attacker can exploit this vulnerability to...

Autodesk Design Review Code Issue Vulnerability

Autodesk Design Review ADR is a suite of AutoCAD drafting software assistance software from Autodesk. The software supports viewing, marking, measuring, printing and tracking changes to 2D and 3D design files. A code issue vulnerability exists in Autodesk Design Review. An attacker could exploit...

Google Android power lifting vulnerability (CNVD-2019-37968)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. Google Android suffers from an elevation of privilege vulnerability. An attacker can exploit this vulnerability to elevate privileges...

Google Android Media Framework Code Execution Vulnerability (CNVD-2019-40845)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Media Framework is one of the multimedia development frameworks. A code execution vulnerability exists in Media framework in Android. An attacker can exploit this vulnerability to execu...

Windows Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system. There are multiple ways an attacker could exploit...

CVE-2019-12725

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. Recent assessments:...

HTTP Unauthorized Brute Force Attempt

A remote attacker can exploit this vulnerability by using HTTP brute force attempt. These attacks are aimed to cause the server to crash or become unresponsive...

Cross-site scripting vulnerability in multiple F5 products (CNVD-2019-32053)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in multiple F5 products. An attacker can exploit the vulnerability to execute...

Shanghai New Win-Win Information Technology Co., Ltd Au Bump Rental Car APP has Denial of Service Vulnerability

Au Rent a Car AP is a taxi and car rental software for life travel. Shanghai New Win-Win Information Technology Company Limited Au Bump Rent A Car AP suffers from a denial-of-service vulnerability, which can be exploited by an attacker to cause the application to crash by sending null, anomalous,...

CVE-2018-6156

Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

CVE-2019-5298

There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. Due to the improper implementation of authentication for the serial port, an attacker could exploit this vulnerability by connecting to the affected products and running a series of...

CVE-2018-12556

CVE-2018-12556 affects the yarnpkg/website install.sh signature verification: it only checks that the release is signed by any key in the user’s local keyring, not pinned to the yarn release key, enabling remote attackers to sign tampered yarn packages with their own key. Public documents note un...

CVE-2019-1735 Cisco NX-OS Software Command Injection Vulnerability (CVE-2019-1735)

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI...

CVE-2019-11005

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of coders/svg.c, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a quoted font family value...

PT-2019-1854 · Ruby On Rails +3 · Action View +3

Name of the Vulnerable Software and Affected Versions: Action View versions prior to 5.2.2.1 Action View versions prior to 5.1.6.2 Action View versions prior to 5.0.7.2 Action View versions prior to 4.2.11.1 Action View version 3 Description: There is a File Content Disclosure issue in Action Vie...

DouPHP suffers from an application reinstallation vulnerability

DouPHP is a lightweight enterprise website management system based on PHP+Mysql architecture, running on various platforms such as Linux, Windows, MacOSX, Solaris and so on. DouPHP suffers from an application reinstallation vulnerability. An attacker can exploit the vulnerability to reinstall the...

LIVE555 Invalid Memory Access Vulnerability

LIVE555 is a set of open source C++ libraries for multimedia streaming. An invalid memory access vulnerability exists in the parseAuthorizationHeader function in versions prior to LIVE555 2019.02.27. An attacker can exploit this vulnerability via a malformed header to cause a memory access error...

EUVD-2019-10238

A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker to retrieve arbitrary files from the targeted device, possibly resulting in information disclosure. The vulnerability is due to improper validation of...