Cisco Integrated Management Controller Command Injection Vulnerability

A vulnerability in the Redfish protocol of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of user-supplied input by th...

CVE-2019-9850

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...

PT-2019-16569 · Zte · Zte Zxhn F670

Name of the Vulnerable Software and Affected Versions: ZTE ZXHN F670 versions prior to V1.1.10P3T18 Description: The issue is related to a command injection vulnerability due to insufficient parameter validation check. This allows an authorized user to exploit the vulnerability and take control o...

Bagisto Cross-Site Request Forgery Vulnerability

Bagisto is a set of open source e-commerce framework. A cross-site request forgery vulnerability exists in Bagisto version 0.1.5, which stems from a WEB application that does not adequately validate whether a request comes from a trusted user, and can be exploited by an attacker to send an...

CloudBees Jenkins XL TestView Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...

CVE-2019-1913

Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to overflow a buffer, which then allows the execution of arbitrary code with root privileges on the underlying operating system. The...

MDaemon Webmail Cross-Site Request Forgery Vulnerability

MDaemon Technologies MDaemon Webmail formerly known as WorldClient is a Web-based e-mail client for MDaemon Email Server from MDaemon Technologies. A cross-site request forgery vulnerability exists in MDaemon Webmail. The vulnerability stems from a WEB application that does not adequately validat...

CVE-2019-1942

A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An...

[ASA-201907-4] firefox: multiple issues

Arch Linux Security Advisory ASA-201907-4 ========================================= Severity: Critical Date : 2019-07-17 CVE-ID : CVE-2019-9811 CVE-2019-11709 CVE-2019-11710 CVE-2019-11711 CVE-2019-11712 CVE-2019-11713 CVE-2019-11714 CVE-2019-11715 CVE-2019-11716 CVE-2019-11717 CVE-2019-11718...

Cross site scripting

Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The...

CVE-2019-1932 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability

A vulnerability in Cisco Advanced Malware Protection AMP for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit thi...

Advantech WebAccess viewsrv SQLGetData Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27F4 IOCTL in the webvrpcs process. The issue resul...

CVE-2018-6121

Insufficient validation of input in Blink in Google Chrome prior to 66.0.3359.170 allowed a remote attacker to perform privilege escalation via a crafted HTML page...

CVE-2018-6121

CVE-2018-6121 affects Google Chrome (Blink/HTML rendering) prior to 66.0.3359.170 where Insufficient validation of input allows a remote attacker to escalate privileges via a crafted HTML page. In the provided documents, the vulnerability is tied to Chrome’s Blink component, with the impact descr...

Oracle Weblogic Insecure Deserialization (CVE-2019-2729)

A vulnerability has been reported in Oracle Weblogic. This vulnerability is due to insufficient validation of data of HTTP requests. Successful exploitation can result in result in arbitrary code execution...

Mozilla Thunderbird < 60.7.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.7.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-20 advisory. - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent...

CVE-2019-1875

Cisco Prime Service Catalog’s web-based management interface is vulnerable to cross-site scripting (XSS) due to insufficient validation of user-supplied input. An authenticated, remote attacker can craft strings added to multiple configuration fields to execute arbitrary script code within the in...

Cisco Integrated Management Controller CLI Command Injection Vulnerability

A vulnerability in the CLI of Cisco Integrated Management Controller IMC could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could explo...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email ECE Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...

The vulnerability of the Nagios Remote Plugin Executor, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the Nagios Remote Plugin Executor NRPE lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...