CVE-2019-1736

A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware Interface UEFI Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to improp...

CVE-2020-7374

Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the us...

Cisco IOS XE Data Forgery Issue Vulnerability (CNVD-2020-31991)

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A data forgery vulnerability exists in software image validation in Cisco IOS XE, which arises from a program not properly checking the code area used to manage the digital signatu...

CVE-2019-9534

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to...

PT-2019-19691 · Cobham · Cobham Explorer 710

Name of the Vulnerable Software and Affected Versions: Cobham EXPLORER 710 firmware version 1.07 Description: The issue concerns the lack of firmware image validation in the device. Development scripts that were left in the firmware can be exploited to upload a custom firmware image. This could...

Cisco Catalyst 3850 Series Switches and 9300 Series Switches IOS XE Data Forgery Issue Vulnerability

Cisco Catalyst 3850 Series Switches and Cisco Catalyst 9300 Series Switches are both products of Cisco Systems. the Cisco Catalyst 3850 Series Switches is a 3850 Series Switch. Cisco Catalyst 9300 Series Switches is a 9300 series switch.IOS XE is an operating system developed for its network...

Design/Logic Flaw

Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image...

CVE-2019-15640

CVE-2019-15640 affects LimeSurvey prior to 3.17.10, where the application does not validate both the MIME type and file extension of an uploaded image. The available data indicate a content-type/extension validation flaw that could affect image handling; CVSS metrics from NVD show a base score of...

CVE-2019-1880

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System UCS C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An...

CVE-2018-15869

An Amazon Web Services AWS developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image A...

Code injection

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected...

CVE-2017-3198

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected...

CVE-2017-3198

CVE-2017-3198 affects GIGABYTE BRIX UEFI firmware for GB-BSi7H-6500 (vF6) and GB-BXi7-5775 (vF2). The root cause is lack of cryptographic validation of firmware images and HTTP delivery of updates, enabling an attacker to modify firmware images without detection and potentially install persistent...

Micro Focus Solutions Business Manager Code Execution Vulnerability

Micro Focus Solutions Business Manager SBM is a suite of business process automation management solutions from Micro Focus UK. The solution is primarily used for process automation, including software development lifecycle and IT business process management. A remote code execution vulnerability...

Monero: forum.getmonero.org Shell upload

Summary: The method uploadProfile in the UsersController allows an attacker to upload a shell to the target server due to lack of image validation. Description: Steps To Reproduce: 1. Open POC https://forum.getmonero.org/uploads/profile/lNobodyl1527340454.php or...

CVE-2014-5282

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'...

CVE-2014-5282

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'...

CVE-2014-5282

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'...

CVE-2014-5282

CVE-2014-5282 affects Docker before 1.3. The issue is improper validation of image IDs during docker load, allowing remote attackers to redirect to a different image by loading untrusted images. Public references across multiple feeds confirm the vulnerability and its impact, with no explicit exp...

CVE-2017-11449

coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via an image received from stdin...