Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.1 Security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...

(0Day) (Pwn2Own) Apple macOS Quarantine Attribute Bypass Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of download...

Klemen Stirn HESK Cross-Site Scripting Vulnerability

Klemen Stirn HESK is a helpdesk software package with an integrated knowledge base from Klemen Stirn, Slovenia. A cross-site scripting vulnerability exists in Klemen Stirn HESK versions prior to 3.1.10, which stems from a lack of proper validation of client-side data by the WEB application and ca...

WordPress Elementor Page Builder Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Elementor Page Builder is a page builder plugin used in it. A cross-site scripting vulnerability exists in WordPress Elementor Page...

Information Exposure

Overview Versions of apollo-server-cloudflare prior to 2.14.2 are vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their...

Gila CMS Remote Code Execution (CVE-2020-5514)

A remote code execution vulnerability exists in Gila CMS. The vulnerability is due to improper validation of user supplied files during image upload...

Sql injection

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this...

CVE-2020-3221 Cisco IOS XE Software Flexible NetFlow Version 9 Denial of Service Vulnerability

A vulnerability in the Flexible NetFlow Version 9 packet processor of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper...

Grafana Cross-Site Scripting Vulnerability (CNVD-2020-36524)

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A cross-site scripting vulnerability exists in Grafana version 5.3.1. The vulnerabilit...

CVE-2020-3641

Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096A...

CVE-2020-3641

CVE-2020-3641 is a Qualcomm closed‑source component issue (Snapdragon) involving an integer overflow when atom size is smaller than atom offset due to improper validation. Affected products span Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables across numerous SoC...

CVE-2020-3641

Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096A...

Red Hat Resteasy Cross-Site Scripting Vulnerability (CNVD-2020-41082)

Red Hat Resteasy is the United States Red Hat Red Hat, a JAX-RS a Java programming language API specification implementation. A cross-site scripting vulnerability exists in Red Hat Resteasy. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

Security Advisory YSA-2020-06 | Yubico

The yubihsm library, included in the yubihsm-shell project, does not properly validate two message fields during device communication. A maliciously-crafted YubiHSM2 device, or someone with access to the HTTP traffic between a client and server handling the device, could cause the yubihsm library...

(Pwn2Own) Apple Safari Symbolic Link Arbitrary Application Execution Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple Safari. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of symboli...

Huawei Data Communication: Numeric Errors Vulnerability in Some Huawei Routers (huawei-sa-20171215-01-router)

Some Huawei routers have a numeric error vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

SUSE-SU-2020:1423-1 Security update for mariadb-connector-c

This update for mariadb-connector-c fixes the following issues: Security issue fixed: - CVE-2020-13249: Fixed an improper validation of OK packets received from clients bsc1171550. Non-security issues fixed: - Update to release 3.1.8 bsc1171550 CONC-304: Rename the static library to libmariadb.a...

jQuery cross-site scripting vulnerability (CNVD-2021-28270)

jQuery is the United States John Resig programmer of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of...

Improper Validation

Overview Affected versions of this package are vulnerable to Improper Validation. Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to...