CVE-2020-11886: Improper Neutralization of Special Elements used in an SQL Command

OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm aka the NodeListController via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21...

DEBIAN-CVE-2019-12521

An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elemen...

CVE-2020-11725

sndctlelemadd in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info-owner line, which later affects a privatesizecount multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were...

Same Origin Policy Bypass

WebKitGTK+ is vulnerable to same origin policy bypass. It was found that WebKit did not correctly restrict read access to images created from the "canvas" element. Malicious web content could allow a remote attacker to bypass the same-origin policy and potentially access sensitive image data...

Use-after-free

WebKitGTK+ is vulnerable to use-after-free. It allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors involving element focus...

CVE-2018-1000622

The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the...

CVE-2019-9790

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 60.6, Firefox ESR 60.6, and Firefox 66...

SQL Injection Vulnerability in Website Building System of Huaihua Fifth Element Network Information Company Limited (CNVD-2020-25547)

Huaihua Fifth Element Network Information Co., Ltd. is an Internet + application services company, Internet technology, marketing, operations, big data analysis, cloud computing applications as the core, to carry out the Internet + industrial integration operation and development. Huaihua Fifth...

kernel: buffer-overflow hardening in WiFi beacon validation code.

A flaw in the Linux kernel's WiFi beacon validation code was discovered. The code does not check the length of the variable length elements in the beacon head potentially leading to a buffer overflow. System availability, as well as data confidentiality and integrity, can be impacted by this...

CVE-2019-11742

A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a canvas element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This...

PT-2022-11605 · Libxml2 +3 · Libxml2 +3

Name of the Vulnerable Software and Affected Versions: VTK versions prior to 9.2.5 Description: The issue is a NULL pointer dereference vulnerability that lies in IO/Infovis/vtkXMLTreeReader.cxx. It occurs because the vendor did not check the return value of the libxml2 API xmlDocGetRootElement a...

PYSEC-2020-28

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False...

CVE-2020-7474

A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator v1.002 and prior, for the PMEPXM0100 H module, which could cause the execution of untrusted code when using double click to open a project file which may trigger execution of a malicious DLL...

CVE-2020-7474

ProSoft Configurator (v1.002 and earlier) is affected by CWE-427 Uncontrolled Search Path Element in the PMEPXM0100(H) module. The vulnerability could enable execution of untrusted code when a user double-clicks to open a project file, potentially triggering a malicious DLL. CVSS details in the s...

SQL injection vulnerability in the pa*** parameter of the ru***.php page of the website building system of Huaihua Fifth Element Network Information Company Limited (CNVD-2020-26552)

Huaihua Fifth Element Network Information Co., Ltd. is an Internet + application services company, Internet technology, marketing, operations, big data analysis, cloud computing applications as the core, to carry out the Internet + industrial integration operation and development. Huaihua Fifth...

PT-2020-1941

Name of the Vulnerable Software and Affected Versions Adobe Photoshop CC 2019 versions 20.0.8 and earlier Adobe Photoshop 2020 versions 21.1 and earlier Description The issue is related to a buffer error in the graphic editor, which could allow a remote attacker to execute arbitrary code on the...

CVE-2018-1000632

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or...

CVE-2020-9440

A cross-site scripting XSS vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor...

CVE-2020-9440

A cross-site scripting XSS vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor...

CVE-2020-9440

A cross-site scripting XSS vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor...