Sylius Cross-Site Scripting Vulnerability

Sylius is a set of Symfony framework based on open source e-commerce platform . A cross-site scripting vulnerability exists in Sylius. The vulnerability stems from the lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to execute...

GitLab CE/EE Cross-Site Scripting Vulnerability (CNVD-2020-03115)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-02548)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress versions prior to 5.3.1. The vulnerability stems from...

Backdrop CMS Cross-Site Scripting Vulnerability (CNVD-2020-03709)

Backdrop CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Backdrop CMS version 1.13.x before 1.13.5 and version 1.14.x before 1.14.2. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker...

Integer overflow

Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass the length check and eventually will lead to buffer overwrite when event data is copied to context buffer in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity,...

Enghouse Systems Web Chat Cross-Site Scripting Vulnerability

Enghouse Systems Web Chat is a web-based online chat application from Enghouse Systems Canada. A cross-site scripting vulnerability exists in Enghouse Systems Web Chat versions 6.1.300.31 and 6.2.284.34. The vulnerability stems from the WEB application's lack of proper validation of client data. ...

CVE-2019-2320

Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053...

CVE-2019-10511: Improper Validation of Array Index

Possibility of memory overflow while decoding GSNDCP compressed mode PDU in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098,...

CVE-2019-2320: Improper Validation of Array Index

Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053...

Foxit Studio Photo < 3.6.6.913 Multiple Vulnerabilities

According to its self-reported version, the Foxit Studio Photo application installed on the remote Windows host is affected by multiple vulnerabilities: - An out-of-bounds read error exist in the TIF file handler when processing InkNames of TIFFSetField due to improper validation of user-supplied...

CVE-2019-4521

Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179...

QNAP Systems Video Station Cross-Site Scripting Vulnerability

QNAP Systems Video Station is a video management and playback application from QNAP Systems. A cross-site scripting vulnerability exists in QNAP Systems Video Station. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker could exploit th...

OPENSUSE-SU-2019:2593-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...

Security update for cpio (moderate)

openSUSE Security Update: Security update for cpio Announcement ID: openSUSE-SU-2019:2596-1 Rating: moderate References: 1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for cpio fixes...

Input validation

Nova 5i pro and Nova 5 smartphones with versions earlier than 9.1.1.190C00E190R6P2and Versions earlier than 9.1.1.175C00E170R3P2 have an improper validation of array index vulnerability. The system does not properly validate the input value before use it as an array index when processing certain...

CVE-2019-5210

Nova 5i pro and Nova 5 smartphones with versions earlier than 9.1.1.190C00E190R6P2and Versions earlier than 9.1.1.175C00E170R3P2 have an improper validation of array index vulnerability. The system does not properly validate the input value before use it as an array index when processing certain...

CVE-2019-5210

The CVE-2019-5210 issue affects Huawei Nova 5i Pro and Nova 5 smartphones with affected versions prior to 9.1.1.190 (C00E190R6P2) and prior to 9.1.1.175 (C00E170R3P2). The root cause is improper validation of array indices when processing certain image information, leading to potential remote cod...

CVE-2019-5210: Improper Validation of Array Index

Nova 5i pro and Nova 5 smartphones with versions earlier than 9.1.1.190C00E190R6P2and Versions earlier than 9.1.1.175C00E170R3P2 have an improper validation of array index vulnerability. The system does not properly validate the input value before use it as an array index when processing certain...

Evernote Directory Traversal (CVE-2019-10038)

A directory traversal vulnerability exists in Evernote. This vulnerability is due to improper validation of embedded links in notes. Successful exploitation could result in arbitrary program execution...

SUSE SLED15 / SLES15 Security Update : cpio (SUSE-SU-2019:3059-1)

This update for cpio fixes the following issues : CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. Note that Tenable Network Security has extracted the preceding...