3985 matches found
CVE-2019-5832
Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
The vulnerability of the web access module of the DIRECTUM electronic document management system allows a hacker to obtain the name of the last authorized user.
The vulnerability of the web access module of the DIRECTUM electronic document management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to obtain the name of the last authorized user who accessed the system remotely...
CVE-2018-16250
The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters...
CVE-2019-12215
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this...
CVE-2019-11819
Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...
DEBIAN-CVE-2019-0227
A Server Side Request Forgery SSRF vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2...
undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service
It was found that URLResource.getLastModified in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak...
edk2: Buffer Overflow in BlockIo service for RAM disk
A flaw was found in edk2. When registering a RAM disk whose size is not a multiple of 512 bytes, the BlockIo protocol produced by the RamDiskDxe driver will incur memory read/write overrun. The memory overrun will happen when reading/writing the last block on the RAM disk. The highest threat from...
Solaris 10 (sparc) : 143725-12
SunOS 5.10: SunFreeware ntp patch. Date this patch was last updated by Sun : Apr/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid124073; scriptversion"1.2"; scriptcvsdate"Date...
Do High Vanity Bitrates Choke Your Live OTT Service Out of the Gate?
Studies show that video consumption demand is growing faster than capacity. While capacity overhead does exist, current trends suggest that we'll see more bottlenecking on last-hop connectivity, especially with regionally targeted content. By pushing "vanity bitrates" -- those topmost speeds that...
typemap is Unmaintained
The maintainer seems unreachable. The crate may or may not be usable as-is despite no maintenance and may not work in future versions of Rust. The last release seems to have been seven years ago. Possible Alternatives The below list has not been vetted in any way and may or may not contain...
Cross site scripting
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...
CVE-2019-9649
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique ....\ to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date...
CVE-2018-20645
PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field...
CVE-2018-20645
PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field...
CVE-2018-20632
PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting XSS via the FIRST NAME or LAST NAME field...
CVE-2018-17167
PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the 1 "Machine Host Name" or "Server Serial Number" field in the clustering configuration, 2 "name" field in the Edit Group configuration, 3 "Rule Name" field in the Access Control configuration, 4...
Cross site scripting
PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting XSS via the FIRST NAME or LAST NAME field...
CVE-2019-7732
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field username, realm, nonce, uri, or response, only the last instance can ever be freed...