Improper Input Validation (RCE)

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service...

Hitachi ABB Power Grids eSOMS Telerik

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Hitachi ABB Power Grids Equipment: eSOMS Telerik Vulnerabilities: Path Traversal, Deserialization of Untrusted Data, Improper Input Validation, Inadequate Encryption Strength, Insufficiently...

JVN#45797538: Multiple vulnerabilities in Cybozu Office

Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1657 Operational restrictions bypass vulnerability in Scheduler CWE-264 - CVE-2021-20624 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2|...

openSUSE Security Update : kernel-firmware (openSUSE-2021-407)

This update for kernel-firmware fixes the following issues : - CVE-2020-12373: Fixed an expired pointer dereference may lead to DOS bsc1181738. - CVE-2020-12364: Fixed a NULL pointer reference may lead to DOS bsc1181736. - CVE-2020-12362: Fixed an integer overflow which could have led to privileg...

Security update for kernel-firmware (important)

openSUSE Security Update: Security update for kernel-firmware Announcement ID: openSUSE-SU-2021:0407-1 Rating: important References: 1181720 1181735 1181736 1181738 Cross-References: CVE-2020-12362 CVE-2020-12363 CVE-2020-12364 CVE-2020-12373 CVSS scores: CVE-2020-12362 NVD : 7.8...

CentOS 8 : nodejs:12 (CESA-2021:0549)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0549 advisory. - nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties CVE-2018-3750 - nodejs-mixin-deep: prototype pollution in...

Adobe Creative Cloud < 5.4 Multiple Vulnerabilities (APSB21-18)

The version of Adobe Creative Cloud installed on the remote Windows host is prior to 5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-18 advisory. - Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a local privilege escalation...

NewStart CGSL MAIN 6.02 : libvpx Multiple Vulnerabilities (NS-SA-2021-0060)

The remote NewStart CGSL host, running version MAIN 6.02, has libvpx packages installed that are affected by multiple vulnerabilities: - In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution...

Adobe Creative Cloud Desktop Application 输入验证错误漏洞

Adobe Creative Cloud Desktop Application is the management software for various Creative Cloud applications and services. An improper input validation vulnerability exists in Adobe Creative Cloud Desktop Application 5.3 and earlier versions. An attacker could exploit the vulnerability to elevate...

SAP 3D Visual Enterprise Viewer 安全漏洞

SAP 3D Visual Enterprise Viewer is a free 3D visualization viewer for Windows. A denial of service vulnerability exists in SAP 3D Visual Enterprise Viewer 9. The vulnerability stems from improper input validation. An attacker could exploit the vulnerability by means of a specially crafted .CGM...

SAP 3D Visual Enterprise Viewer 安全漏洞

SAP 3D Visual Enterprise Viewer is a free 3D visualization viewer for Windows. A denial of service vulnerability exists in SAP 3D Visual Enterprise Viewer 9. The vulnerability stems from improper input validation. An attacker could exploit the vulnerability by means of a specially crafted .JT...

Secomea GateManager Cross-Site Scripting Vulnerability

GateManager is a VPN server from Secomea. A cross-site scripting vulnerability exists in the web GUI of Secomea GateManager versions prior to 9.4. The vulnerability stems from improper input validation. An attacker can exploit the vulnerability to execute arbitrary javascript code...

CVE-2020-29029

Improper Input Validation, Cross-site Scripting XSS vulnerability in Web GUI of Secomea GateManager allows an attacker to execute arbitrary javascript code. This issue affects: Secomea GateManager all versions prior to 9.4...

CVE-2020-29029

Summary of CVE-2020-29029 : The vulnerability is an XSS/backdoor-like risk in the Web GUI of Secomea GateManager caused by improper input validation. Affects Secomea GateManager versions before 9.4. Impact stated across sources as arbitrary JavaScript execution in the user’s browser without authe...

CVE-2021-21978

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could uploa...

Out-of-bounds

In jpeg, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05433311...

Information disclosure

In mobilelogd, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05457039...

CVE-2021-0402

In jpeg, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05433311...

LMA-ISIDA Retriever SQL Injection Vulnerability

LMA-ISIDA Retriever is an application of the Russian company LMA-ISIDA. It provides management and information support on enterprise, regional scale. A security vulnerability exists in LMA ISIDA Retriever 5.2, which arises from a lack of proper validation of user-entered data by a network system ...

CVE-2020-11988

Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users...