CVE-2021-23278

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/mapssrv.js with action removeBackground and server/nodeupgradesrv.js with action removeFirmware. An attacker can send specially...

Improper Input Validation

Overview puppet is an automated configuration management tool. Affected versions of this package are vulnerable to Improper Input Validation. Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed...

Improper Input Validation in klona

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona...

Improper Input Validation

sopelpluginschannelmgnt suffers from improper input validation. The issue causes the removal of the bot to the allowed when multiple users are specified to be kicked/banned at once using the , or delimeters...

CVE-2021-21433 Remote code execution on discord-recon .dirsearch and .arjun commands due to improper input validation

Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2...

CVE-2021-25360

CVE-2021-25360 affects the libswmfextractor library prior to Samsung SMR APR-2021 Release 1. The root cause is improper input validation, which allows attackers to execute arbitrary code on the mediaextractor process. Remediation: update to SMR APR-2021 Release 1 or later. Exploitation details ar...

CVE-2021-25360

An improper input validation vulnerability in libswmfextractor library prior to SMR APR-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process...

Samsung SMR 缓冲区错误漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A buffer overflow vulnerability exists in versions prior to SMR APR-2021 Release 1, which stems from improper input validation and can be exploited by an attacker to execute...

PT-2021-16553 · Unknown · Libswmfextractor

Name of the Vulnerable Software and Affected Versions: libswmfextractor library versions prior to SMR APR-2021 Release 1 Description: The issue is related to improper input validation in the libswmfextractor library, which allows attackers to execute arbitrary code on the mediaextractor process...

Heap overflow

A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data...

CVE-2021-3482

A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data...

squid: improper input validation may allow a trusted client to perform HTTP request smuggling

A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest threat from this...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in sebhildebrandt/systeminformation

✍️ Description The systeminformation package is vulnerable to Improper Input Validation through versions function. 🕵️‍♂️ Proof of Concept javascript // PoC.js const si = require'systeminformation'; si.versionstoString : = console.log"This is a PoC" ; 💥 Impact This vulnerability allows attackers to...

RHEL 7 : squid (RHSA-2021:1135)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1135 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: improper inpu...

CVE-2021-1892

Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Wired Infrastructure and Networking...

Hitachi Energy Relion 670, 650 and SAM600-IO

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Relion 670, 650, and SAM600-IO Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

CVE-2021-1747

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing maliciously crafted web content may lead to code executi...

CVE-2021-1805

An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2.1, macOS Catalina 10.15.7 Supplemental Update, macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges...

Huawei P30 Memory Write Vulnerability

Huawei P30 is a smartphone from Chinese company Huawei Huawei. The Huawei P30 suffers from a memory write vulnerability when handling file parsing. The vulnerability stems from the program not properly validating input files. An attacker could exploit the vulnerability to cause the program to ser...

CVE-2021-23279

Eaton Intelligent Power Manager IPM prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in metadriversrv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete...