4453 matches found
CVE-2020-3498: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted...
GitLab Cross-Site Scripting Vulnerability (CNVD-2020-51539)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...
Cisco Jabber for Windows Information Disclosure (cisco-sa-jabber-ttcgB9R3)
According to its self-reported version, Cisco Jabber is affected by a information disclosure vulnerability. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful...
PT-2020-3843
Name of the Vulnerable Software and Affected Versions: Cisco Jabber for Windows affected versions not specified Description: A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code due to improper validation of message contents. An...
PT-2020-3855
Name of the Vulnerable Software and Affected Versions: Cisco Jabber for Windows affected versions not specified Description: The issue is related to improper validation of message contents, which could allow an authenticated, remote attacker to gain access to sensitive information. An attacker...
PT-2020-3854
Name of the Vulnerable Software and Affected Versions: Cisco Jabber software affected versions not specified Description: The issue is related to improper validation of message contents, which could allow an authenticated, remote attacker to gain access to sensitive information. An attacker could...
Input validation
A flaw exists in Trading Technologies Messaging 7.1.28.3 ttmd.exe due to improper validation of user-supplied data when processing a type 8 message sent to default TCP RequestPort 10200. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to terminate...
PT-2020-18206
Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 7.1.0.000 through 7.1.10 IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.9 Description The issue is caused by improper validation of data prior to export, which may allow an...
Security Bulletin: Denial of Service vulnerability in IBM Spectrum Protect Server (CVE-2020-4559)
Summary The IBM Spectrum Protect Server is vulnerable to a denial of service due to improper validation of user-supplied input. Vulnerability Details CVEID: CVE-2020-4559 DESCRIPTION: IBM Spectrum Protect Server could allow an attacker to cause a denial of service due to improper validation of...
Chrony Denial of Service Vulnerability (CNVD-2020-50554)
Chrony is a general-purpose implementation of the Network Time Protocol NTP that synchronizes the system clock with an NTP server. A denial of service exists in the Chrony product. The vulnerability stems from a network system or product that does not properly validate incoming data, and could be...
CVE-2020-4559
IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613...
PT-2020-18131
Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect versions 7.1 through 8.1 Description The issue is due to improper validation of user-supplied input, which could allow an attacker to cause a denial of service. Recommendations For IBM Spectrum Protect versions 7.1 through...
Input validation
A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system. The vulnerability is due to improper validation of URL parameters that are sent from a website to the affected application. An attack...
CVE-2020-3440 Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability
A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system. The vulnerability is due to improper validation of URL parameters that are sent from a website to the affected application. An attack...
CVE-2020-17394: Improper Validation of Array Index
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists...
CVE-2020-17398: Improper Validation of Array Index
This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...
CVE-2020-17401: Improper Validation of Array Index
This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists...
vBulletin Cross-Site Scripting Vulnerability
vBulletin is the United States InternetBrands and vBulletinSolutions, Inc. of a PHP and MySQL-based open source Web forum program . A cross-site scripting vulnerability exists in vBulletin version 5.x. The vulnerability stems from the lack of proper validation of client-side data by the WEB...
CVE-2020-15694
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get.contentLength does not raise any error if a malicious server provides a negative Content-Length...