Cross site request forgery (csrf)

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery CSRF in many functions, like adding – deleting for hosts or servers...

Command Execution Vulnerability in Smart Store System

Smart Store System is a store management system tailor-made for retail stores by Kingdee Software. There is no need to buy a new machine, and the original cash register equipment can be adapted to the system, which can be used by multiple cash registers, cell phones and computers together to...

Command Execution Vulnerability in Huaan Securities Online Trading Software

hereinafter referred to as "Hua An Securities" was approved by the China Securities Regulatory Commission on December 28, 2000 was incorporated as a securities company, formerly known as the May 1991 establishment of the Anhui Provincial Securities Company, with a registered capital of 2.821...

Command Execution Vulnerability in Programming Cat PC Client

Programming Cat is a fun programming software developed for children and teenagers over 8 years old. Programming Cat computer client has a command execution vulnerability that can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary functions...

Command Execution Vulnerability in LeTeachLearning Teacher Side

LeTeachLearn Teacher Terminal is a trinity communication and teaching software for school teachers. A command execution vulnerability exists in Lejiao Lexue Teacher's Terminal, which can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary...

Programming Cat Format Factory Command Execution Vulnerability

Programming Cat Format Factory is a useful programming format conversion tool. Programming Cat Format Factory suffers from a command execution vulnerability that can be exploited by an attacker to inject an executable DLL file into a client process to perform arbitrary functions...

Command Execution Vulnerability in Xiaozhi Desktop

Smart Desktop is a desktop organizer that improves office efficiency. Xiaozhi Desktop suffers from a command execution vulnerability, which can be exploited by an attacker to inject an executable DLL file into a client process to perform arbitrary functions...

CVE-2020-15293

Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of service conditions...

postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption...

Security Bulletin: IBM Cloud Functions web actions API endpoint change

Summary In order to improve the stability of the service and to prevent potential weaknesses in the services' web actions functionality we introduced a new IBM Cloud Functions API endpoint .functions.appdomain.cloud for web actions which use text/html response data. The previously used API endpoi...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

CVE-2020-0485

In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-25234

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3, LOGO! Soft Comfort All versions V8.3. The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions UDF in a password protected way. This...

CVE-2020-25234

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3, LOGO! Soft Comfort All versions V8.3. The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions UDF in a password protected way. This...

Information disclosure

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3, LOGO! Soft Comfort All versions V8.3. The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions UDF in a password protected way. This...

CVE-2020-25234

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3, LOGO! Soft Comfort All versions V8.3. The LOGO! program files generated and used by the affected components offer the possibility to save user-defined functions UDF in a password protected way. This...

CVE-2020-28858

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions...

PolyAsciiShellGen

It is an offensive tool for x86 platforms. The primary CVE ID present in the provided context is not explicitly stated, but the tool is related to bypassing MSB data filters for buffer overflow exploits on Intel x86 platforms, as described in the paper "Bypassing MSB Data Filters for Buffer...

OSV-2020-2253 Global-buffer-overflow in g_date_time_get_ymd

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28477 Crash type: Global-buffer-overflow READ 2 Crash state: gdatetimegetymd gdatetimegetyear gdatetimeformatutf8...

Memory corruption

Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. This vulnerability affects Firefox 83...