Microsoft Windows Hyper-V Information Disclosure Vulnerability (CNVD-2019-35574)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is a set of operating systems for personal devices.Microsoft Windows Server is a set of server operating systems. Windows Hyper-V is one of the virtualization products that supports...

CVE-2019-0370

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection...

SugarCRM PHP code injection vulnerability (CNVD-2019-34428)

SugarCRM is a set of open source customer relationship management software . A PHP code injection vulnerability exists in the EmailMan module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit the vulnerability to execute arbitrary code...

SugarCRM Administration Module SQL Injection Vulnerability

SugarCRM is a set of open source customer relationship management software . A SQL injection vulnerability exists in the Administration module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit this vulnerability to inject custom PHP code...

The vulnerability in the implementation of the SXPv4 protocol for Cisco IOS and Cisco IOS XE operating systems allows a hacker to perform a system reboot on network equipment.

The vulnerability of the SXPv4 protocol for Cisco IOS and Cisco IOS XE operating systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, who operates remotely and has completed the authentication process, to trigger a reboot of network...

Apple Xcode ld64 component arbitrary code execution vulnerability (CNVD-2019-37184)

Apple Xcode is a set of integrated development environments IDEs provided to developers by Apple, Inc. that are used to develop applications for Mac OS X and iOS. ld64 is one of the Apple toolchain linking programs. An arbitrary code execution vulnerability exists in the ld64 component of Apple...

CVE-2019-1634

A vulnerability in the Intelligent Platform Management Interface IPMI of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system OS. The vulnerability is due to...

cPanel cross-site scripting vulnerability (CNVD-2019-28987)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the listftpstable AP in versions prior to cPanel 60.0.25. The vulnerabili...

cPanel SQL Injection Vulnerability (CNVD-2019-26253)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A SQL injection vulnerability exists in versions prior to cPanel 57.9999.54. The vulnerability stems from a lack of validation of...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-24801)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM version 5.6.4. The vulnerability stems from the WEB application lacking...

Teclib GLPI Cross-Site Scripting Vulnerability

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in the...

Eventum Cross-Site Scripting Vulnerability (CNVD-2019-39387)

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site scripting vulnerability exists in the /htdocs/popup.php file in Eventum version 3.5.0. The vulnerability stems from a lack of proper validation of client-side...

D-Link Central WiFi Manager (CWM-100) Arbitrary SQL Command Query Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool. An arbitrary SQL command query vulnerability exists in D-Link Central WiFi Manager CWM-100 versions prior to 1.03R0100BETA6. The vulnerability stems from a failure to validate input. An attacker can exploit...

CVE-2019-11409

app/operatorpanel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when...

FusionPBX Operator Panel module cross-site scripting vulnerability (CNVD-2019-40060)

FusionPBX is a scalable, multi-threaded communication platform. The platform can be used as a call center server, fax server, voip server, voicemail server, conference server and voice application server, etc. Operator Panel module is one of the operator panel modules. The platform can be used as...

CVE-2019-0885

A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'...

DEBIAN-CVE-2019-10050

A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control...

Foxit Studio Photo Remote Code Execution Vulnerability (CNVD-2019-12138)

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A security vulnerability exists in the handling of EZI files in Foxit Studio Photo 3.6.6.779 and prior versions, which arises from the program failing to properly validate user-submitted input. An attacker...

CVE-2019-0764

A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'...

CVE-2019-0690

A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0695, CVE-2019-0701...