CVE-2019-1905 Cisco Email Security Appliance GZIP Content Filter Bypass Vulnerability

A vulnerability in the GZIP decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of GZIP-formatted files. An attacke...

CVE-2018-5883

Buffer overflow in WLAN driver event handlers due to improper validation of array index in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS405, QCS605, SD 636, SD 675, SD 730, SD...

CVE-2018-5883

CVE-2018-5883 describes a buffer overflow in WLAN driver event handlers caused by improper validation of array index. Affected products include Qualcomm Snapdragon family devices such as MDM9206/9607/9640/9650, MSM8996AU, QCS405/QCS605, SD 636/675/730/820A/835/855, SDA660, SDM630/660/SDX20/SDX24,...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2019-34776)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2019-34775)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

CVE-2019-0906: Improper Validation of Array Index

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system. An attacker could exploit this vulnerability by enticing a victim to...

CVE-2019-10155: Improper Validation of Integrity Check Value

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects...

Input validation

In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function provided by the scripting engine allows an attacker to cause a denial of service by crashing the application...

CVE-2019-12554

In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function provided by the scripting engine allows an attacker to cause a denial of service by crashing the application...

CVE-2019-12553

In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function provided by the scripting engine allows an attacker to overwrite arbitrary memory, which could lead to code execution...

CVE-2019-1882

A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting XSS attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit this vulnerability by...

CVE-2019-12555

In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function provided by the scripting engine allows an attacker to cause a denial of service by crashing the application...

CVE-2019-12553

In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function provided by the scripting engine allows an attacker to overwrite arbitrary memory, which could lead to code execution...

CVE-2019-1882: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting XSS attacks. The vulnerability is due to improper validation of content submitted to the affected application. An attacker could exploit this vulnerability by...

Apple Safari HTMLFormElement Improper Validation of Array Index Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within HTMLFormElement...

ZOHO ManageEngine OpManager Cross-Site Scripting Vulnerability (CNVD-2019-24537)

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A cross-site scripting vulnerability exists in ZOHO ManageEngine OpManager version 12.2. The vulnerability stems from a lack of proper validation of client data by the web application. An...

Zimbra Collaboration Suite mailboxd Component Cross-Site Scripting Vulnerability

Zimbra Collaboration Suite ZCS is an open source collaboration suite from the American company Zimbra. The product includes WebMail, calendar, address book , etc. mailboxd is one of the e-mail component . A cross-site scripting vulnerability exists in the mailboxd component in Zimbra ZCS versions...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-15656)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange GmbH OX App Suite versions 7.8.3 and earlier. The...

CVE-2018-11927: Improper Validation of Array Index

Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

Zoho ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-15667)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...