CVE-2020-5555

Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unspecified vector due to the improper input validation issue...

CVE-2020-5555

Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where it is placed via unspecified vector due to the improper input validation issue...

CVE-2020-5555

CVE-2020-5555 affects Shihonkanri Plus GOOUT (Ver1.5.8, Ver2.2.10). The issue stems from improper input validation, enabling remote attackers to read and write files in the server directory (and, for CVE-2020-5554, in arbitrary file paths). Connected docs corroborate multiple vulnerabilities in t...

(Pwn2Own) TP-Link Archer A7 DNS Response Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. The issue results from the lack of prope...

CVE-2019-4001

CVE-2019-4001 affects Druva inSync Client 6.5.0. The issue is an improper input validation vulnerability that allows a local, authenticated attacker to execute arbitrary NodeJS code. Root cause and detailed exploit steps are not provided in the connected documents. The CVSS metrics indicate a loc...

Intel Raid Web Console 3 DISCOVERY Denial of Service

Summary An exploitable denial of service vulnerability exists in the web API functionality of Intel Raid Web Console 3. A specially crafted request can cause the LSA.exe service to exit, resulting in a denial of service. A remote unauthenticated attacker can send a malicious POST request to trigg...

Apache Traffic Server Environment Issue Vulnerability (CNVD-2020-21910)

Apache Traffic Server ATS is the United States Apache Apache Software Foundation's set of scalable HTTP proxy and caching server. An environmental issue vulnerability exists in Apache ATS versions 6.0.0 through 6.2.3, 7.0.0 through 7.1.8, and 8.0.0 through 8.0.5, which stems from incorrect input...

python-flask: Denial of Service via crafted JSON file

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

Security fix for the ALT Linux 9 package squid version 4.10-alt1

4.10-alt1 built March 16, 2020 Alexey Shabalin in task 247850 --- March 14, 2020 Alexey Shabalin - Updated to 4.10. - Fixes: + CVE-2019-12526 Heap Overflow issue in URN processing. + CVE-2019-12523 Multiple issues in URI processing. + CVE-2019-18676 Multiple issues in URI processing. +...

CVE-2019-6696

An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage...

Input validation

In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Andro...

CVE-2020-0088

CVE-2020-0088 affects Android 10 and is caused by an issue in parseTrackFragmentRun within MPEG4Extractor.cpp that can lead to resource exhaustion and a remote Denial of Service. Exploitation requires user interaction. The description does not specify the exact vulnerable versions beyond Android-...

(Pwn2Own) Xiaomi Mi9 Browser ParseFormalParameterList Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Mi9 Browser. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2019-5159

CVE-2019-5159 affects WAGO e!COCKPIT 1.6.0.7. The vulnerability arises from improper input validation in the firmware update mechanism, allowing a crafted firmware update (wup) package to cause writing of arbitrary files to arbitrary locations on WAGO controllers during update. The flaw is trigge...

CVE-2020-0034

In vp8decodeframe of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product...

CVE-2020-0034

In vp8decodeframe of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product...

UBUNTU-CVE-2020-0034

In vp8decodeframe of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product...

CVE-2020-0050

CVE-2020-0050 is an Android System issue affecting Android 10 where in nfa_hciu_send_msg (nfa_hci_utils.cc) an out-of-bounds write can occur due to improper input validation. This could enable local elevation of privilege in the NFC server with system-level execution privileges; exploitation does...

CVE-2020-0034

In vp8decodeframe of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product...

Input validation

An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues...