Grafana Cross-Site Scripting Vulnerability (CNVD-2020-36524)

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A cross-site scripting vulnerability exists in Grafana version 5.3.1. The vulnerabilit...

PT-2020-2691

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code with root privilege...

CVE-2020-3641

Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096A...

CVE-2020-3641

Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096A...

CVE-2020-3641

CVE-2020-3641 is a Qualcomm closed‑source component issue (Snapdragon) involving an integer overflow when atom size is smaller than atom offset due to improper validation. Affected products span Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables across numerous SoC...

Red Hat Resteasy Cross-Site Scripting Vulnerability (CNVD-2020-41082)

Red Hat Resteasy is the United States Red Hat Red Hat, a JAX-RS a Java programming language API specification implementation. A cross-site scripting vulnerability exists in Red Hat Resteasy. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

CVE-2020-11041: Improper Validation of Array Index

In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend alsa, oss, pulse, .... The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot...

(Pwn2Own) Apple Safari Symbolic Link Arbitrary Application Execution Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple Safari. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of symboli...

Huawei Data Communication: Numeric Errors Vulnerability in Some Huawei Routers (huawei-sa-20171215-01-router)

Some Huawei routers have a numeric error vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

SUSE-SU-2020:1423-1 Security update for mariadb-connector-c

This update for mariadb-connector-c fixes the following issues: Security issue fixed: - CVE-2020-13249: Fixed an improper validation of OK packets received from clients bsc1171550. Non-security issues fixed: - Update to release 3.1.8 bsc1171550 CONC-304: Rename the static library to libmariadb.a...

CVE-2020-13249

libmariadb/mariadblib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadblib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle...

jQuery cross-site scripting vulnerability (CNVD-2021-28270)

jQuery is the United States John Resig programmer of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of...

Improper Validation

Overview Affected versions of this package are vulnerable to Improper Validation. Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to...

Design/Logic Flaw

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to...

CVE-2020-12255

rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to...

PT-2020-19806

Name of the Vulnerable Software and Affected Versions ALSong versions 3.46 and earlier Description The issue is caused by improper validation of user input, leading to a Document Object Model DOM based cross-site scripting vulnerability. A remote attacker could exploit this by tricking the victim...

PT-2020-13396

Name of the Vulnerable Software and Affected Versions MariaDB Connector/C versions prior to 3.1.8 Description The issue is related to the improper validation of the content of an OK packet received from a server in the libmariadb/mariadb lib.c file. This problem does not affect any MySQL componen...

Trend Micro Apex One and OfficeScan Directory Traversal (CVE-2020-8599)

A directory traversal vulnerability exists in Trend Micro Apex One and OfficeScan. The vulnerability is due to improper validation of user-supplied file name in the request...

CVE-2020-12022

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed...

Input validation

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed...