Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-32809)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a...

Samsung Competitive Conditions for Mobile Devices Vulnerability (CNVD-2020-32821)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a competitive conditions issue vulnerability that can be exploited by attackers to execute arbitrary code on the system with the...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-32804)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. The Samsung mobile device buffer overflow vulnerability can be exploited by an attacker to execute arbitrary code on the system with the help of a specially crafted...

Apache Solr 8.3.0 Velocity Template Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' class MetasploitModule 'Apache Solr Remote Code Execution via Velocity Template', 'Description' = %q This module exploits a...

Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)

Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...

IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20698)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

Apache Shiro Authentication Bypass Vulnerability

Apache Shiro is the United States Apache Apache Software Foundation for the implementation of authentication , authorization , encryption and session management of the Java security framework . A security vulnerability exists in Apache Shiro versions prior to 1.5.2. An attacker could exploit the...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-40837)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a specially craft...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-40820)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a specially craft...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-33793)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. Samsung mobile devices suffer from a buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a specially crafted...

Samsung Mobile Device Resource Management Error Vulnerability (CNVD-2020-40846)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by attackers with the help of a specially crafted request to execute arbitrary code or...

ELOG Electronic Logbook Code Issue Vulnerability

ELOG is a web application written in C for creating personal and general purpose logs. A code issue vulnerability exists in the handling of HTTP parameters in ELOG Electronic Logbook version 3.1.4-283534d, which can be exploited by remote attackers to cause a denial of service via a specially...

Null pointer dereference

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP parameters. A crafted request...

CVE-2020-8859

Removed by vendor...

fastify-multipart resource management error vulnerability

fastify-multipart is a package that supports parsing multiple content types. A resource management error vulnerability exists in versions prior to fastify-multipart 1.0.5, which can be exploited to crash an application with a specially crafted request...

CVE-2020-8136

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

CVE-2020-8136

Prototype pollution vulnerability in fastify-multipart 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request...

Unspecified Vulnerability in Comba Telecom AP2600-I (CNVD-2020-22256)

Comba Telecom AP2600-I is a wireless access point device from Comba Telecom India. A security vulnerability exists in Comba Telecom AP2600-I devices A02,0202N00PD2 and earlier versions, which can be exploited by remote attackers with the help of a specially crafted request to obtain sensitive...

Design/Logic Flaw

Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login...

CVE-2020-3265

A vulnerability in Cisco SD-WAN Solution software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to ...