Wowza Media Systems Streaming Engine Cross-Site Scripting Vulnerability (CNVD-2020-49528)

Wowza Media Systems Streaming Engine is a suite of streaming media server software from Wowza Media Systems in the United States. A cross-site scripting vulnerability exists in Wowza Media Systems Streaming Engine versions prior to 4.8.5. The vulnerability stems from a lack of proper validation o...

Cisco SD-WAN Solution Privilege Permission and Access Control Issues Vulnerability (CNVD-2020-50563)

Cisco SD-WAN Solution is a set of network extension solutions from Cisco. A privilege-granting and access-control issue vulnerability exists in Cisco SD-WAN Solution versions prior to 18.3.0, which arises from the program failing to properly validate input. A local attacker could exploit this...

The vulnerability of the Sample apps component of the Oracle WebLogic Server application server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Sample apps component of the Oracle WebLogic Server application server is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Vulnerability of the Windows OLE operating system component, allowing a hacker to execute arbitrary code

The vulnerability of the Windows OLE operating system is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cisco Data Center Network Manager Command Injection Vulnerability

Cisco Data Center Network Manager DCNM is a data center management system from Cisco. The system works with Cisco Nexus and MDS series switches and provides storage visualization, configuration and troubleshooting. A security vulnerability exists in the REST API endpoint in Cisco DCNM versions...

The vulnerability of the Enterprise Config Management component of the Enterprise Manager Base Platform allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Enterprise Config Management component of the Enterprise Manager Base Platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or to gain unauthorized access to...

The vulnerability of the Java VM component of the Oracle Database Server database management system allows a hacker to gain full control over the application.

The vulnerability of the Java VM component of the Oracle Database Server management system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full control over the application...

The vulnerability of the CRM User Management Framework component of Oracle Common Applications allows a hacker to gain access to modify, add, or delete data.

The vulnerability of the CRM User Management Framework component of Oracle Common Applications is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain access to modify, add, or delete data...

The vulnerability of the Investor Module component of the Primavera Portfolio Management software, a software solution for automating management processes in production operations, allows a perpetrator to gain access to modify, add, or delete data, or to unauthorizedly access protected information.

The vulnerability of the Investor Module component of Primavera Portfolio Management software exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, or gain unauthorized access to protected...

keycloak: missing input validation in IDP authorization URLs

A flaw was found in Keycloak, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients...

The vulnerability of the implementation of the VPN Secure Sockets Layer (SSL) function in the microprogramming software for Cisco Small Business RV340, Cisco Small Business RV340W, Cisco Small Business RV345, and Cisco Small Business RV345P routers allows a perpetrator to execute arbitrary code or cause service interruptions.

The vulnerability of the VPN Secure Sockets Layer SSL implementation in microprogramming software for Cisco Small Business RV340, Cisco Small Business RV340W, Cisco Small Business RV345, and Cisco Small Business RV345P routers exists due to insufficient validation of input data. Exploiting this...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a attacker to execute arbitrary SQL queries.

The vulnerability in the vManage web interface of the Cisco SD-WAN software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2020-0107

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

The vulnerability of the mwifiex_cmd.AppendAppend_vsie_tlv() function in Marvell Linux kernel drivers allows a hacker to escalate their privileges or cause service failures.

The vulnerability of the mwifiexcmd.AppendAppendvsietlv function in Marvell Linux kernel drivers is related to incorrect input validation. Exploiting this vulnerability can allow an attacker to gain elevated privileges or cause service interruptions...

The vulnerability of the xfs_agf_verify function in the XFS file system of Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the xfsagfverify function in the XFS file system of Linux operating systems is related to incorrect input validation. Exploiting this vulnerability can allow an attacker to cause a service failure by synchronizing a specially created file with the metadata of the mounted XFS...

CVE-2020-3332

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, remote attacker to inject arbitrary shell commands that are executed by an affected device. The vulnerability is due to insufficient input...

CVE-2020-3140

A vulnerability in the web management interface of Cisco Prime License Manager PLM Software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of user input on the web management interface. An...

Security Update for Microsoft Visual Studio Code ESLint Extension (July 2020)

An input-validation flaw exists in Visual Studio Code Live Share Extension related to handling source code validation upon project opening that allows remote code execution. An attacker can convince a user to clone a specified repository and to open it in Visual Studio Code leading to code...

The vulnerability of the Secdo security incident investigation software lies in the insufficient validation of input data, allowing an intruder to add data to the root directory.

The vulnerability of the Secdo security incident investigation software exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to add data to the root catalog...

The vulnerability of the SSBD component in the Linux operating system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the SSBD component in the Linux operating system’s kernel is related to insufficient validation of input data and improper implementation of functions. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...