CVE-2019-6552

Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution...

buttle npm package cross-site scripting vulnerability

buttle npm package is a static file server. A cross-site scripting vulnerability exists in version 0.2.0 of the buttle npm package, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Microsoft Windows gdiplus EMF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

OverIT Geocall Cross-Site Scripting Vulnerability

OverIT Geocall is a field service management solution from OverIT Italy. A cross-site scripting vulnerability exists in version 6.3 prior to OverIT Geocall build 2:346977, which stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the...

Palo Alto Networks Expedition Migration Tool Cross-Site Scripting Vulnerability (CNVD-2019-14250)

Palo Alto Networks Expedition Migration Tool is a security policy configuration migration tool from Palo Alto Networks, USA. A cross-site scripting vulnerability exists in Palo Alto Networks Expedition Migration Tool version 1.1.8 and prior versions, which stems from a lack of proper validation o...

Binary Vulnerability in Foxit Reader U3D Plugin

Foxit Software Incorporated Foxit Software is a provider of product technology and solutions that cover the document lifecycle, including document generation, conversion, display, editing, searching, printing, storage, signing, forms, protection, and secure distribution management. Binary...

CVE-2018-14814

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object...

CVE-2018-14814

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object...

Code injection

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object...

CVE-2018-14814

PI Studio HMI from Wecon (PI Studio HMI: v4.1.9 and earlier; PI Studio: v4.2.34 and earlier) is affected by an out-of-bounds read (CWE-125) due to improper validation of user-supplied data, potentially reading beyond an allocated object and causing information disclosure. Multiple sources corrobo...

Prometheus Cross-Site Scripting Vulnerability

Prometheus is open source software written in the Go language for recording real-time metrics from time-series databases built using the HTTP pull model. A cross-site scripting vulnerability exists in Prometheus versions prior to 2.7.1 that stems from a lack of proper validation of client-side da...

Drupal cross-site scripting vulnerability (CNVD-2019-12155)

Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal version 7 prior to 7.65, version 8.6 prior to 8.6.13, and version 8.5 prior to 8.5.14, which stems from a lack of proper validation of...

CVE-2019-6729

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of P...

CVE-2019-6735

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2019-6735

CVE-2019-6735 affects Foxit Reader. A vulnerability in PDF file processing causes an out-of-bounds read due to lack of proper validation of user-supplied data, potentially disclosing sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malicious fi...

The vulnerability of the NTLM type-2 function of the libcurl library, which allows a hacker to trigger a service failure

The vulnerability of NTLM type-2 in the libcurl library is related to incorrect validation of incoming data, which leads to reading beyond the buffer of dynamic memory. Exploiting this vulnerability allows a remote attacker to cause a service failure...

Updated python-gnupg packages fix security vulnerability

When symmetric encryption is used, data can be injected through the passphrase property of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods. The supplied passphrase is not validated for newlines, and the library passes --passphrase-fd=0 to the gpg executable, which expects the passphrase on th...

The vulnerability of the Junos operating system, related to insufficient validation of input data, allows a perpetrator to trigger a service failure.

The vulnerability of the Junos operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

Horner Automation Cscape CSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Horner Automation Cscape. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Authentication Bypass

Mosquitto is vulnerable to authentication bypass due to incorrect data validation. Clients are granted access to the broker because it incorrectly validated empty lines or malformed data in the password file, treating such data as a valid username and allowing an attacker to bypass authentication...