1110 matches found
Code injection
Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...
The vulnerability in the web interface of the Cisco Data Center Network Manager (DCNM) allows a attacker to perform cross-site scripting attacks (XSS).
The vulnerability of the Web interface of the Cisco Data Center Network Manager DCNM exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS by injecting malicious data in...
Security Bulletin: Multiple vulnerabilities have been identified in IBM Tivoli Netcool/OMNIbus Probe for Network Node Manager i (CVE-2009-3555)
Summary Information about security vulnerabilities affecting IBM Tivoli Netcool/OMNIbus Probe for Network Node Manager i is published in the details below. Vulnerability Details CVEID: CVE-2009-3555 DESCRIPTION: Multiple implementations of the Transport Layer Security TLS protocol, including SSL,...
CVE-2020-7505
A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system...
CVE-2020-7505
A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 Firmware version 1.5.2 and older which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system...
CVE-2020-6260
SAP Solution Manager Trace Analysis, version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist...
PT-2020-19055
Name of the Vulnerable Software and Affected Versions SAP Solution Manager Trace Analysis version 7.20 Description The issue allows an attacker to inject superfluous data that can be displayed by the application due to Incomplete XML Validation. This results in the application showing additional...
Depth counting error in guard() leading to multiple potential security issues in aioxmpp
Impact Possible remote Denial of Service or Data Injection. Patches Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix. Workarounds To make the bug exploitable, an error...
GHSA-6M9G-JR8C-CQW3 Depth counting error in guard() leading to multiple potential security issues in aioxmpp
Impact Possible remote Denial of Service or Data Injection. Patches Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix. Workarounds To make the bug exploitable, an error...
CVE-2020-8486
Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...
CVE-2020-8487
Insufficient protection of the inter-process communication functions in ABB System 800xA Base all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...
CVE-2020-8489
Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management all published versions enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management...
Design/Logic Flaw
Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...
Design/Logic Flaw
Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...
CVE-2020-8488
Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities...
CVE-2020-8485
Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...
CVE-2020-8489
Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management all published versions enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management...
CVE-2020-8487
Insufficient protection of the inter-process communication functions in ABB System 800xA Base all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...
CVE-2020-8486
Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...
CVE-2020-8478
Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl all published versions enables an attacker authenticated on the local system to inject data, affecting the online view...