CVE-2019-12369: Improper Neutralization of Input During Web Page Generation

The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

PT-2020-9302

Name of the Vulnerable Software and Affected Versions Newton application versions prior to 10.0.24 Description The issue allows for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute. This can occur if the application has the READ EXTERNAL STORAGE...

CVE-2019-12365: Improper Neutralization of Input During Web Page Generation

The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

PT-2020-9305

Name of the Vulnerable Software and Affected Versions Edison Mail versions 1.7.1 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For Edison Mail...

CVE-2019-12368: Improper Neutralization of Input During Web Page Generation

The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

PT-2020-9307

Name of the Vulnerable Software and Affected Versions Spark application versions 2.0.2 and earlier Description The issue allows for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute, provided the application has the READ EXTERNAL STORAGE permission...

PT-2020-9306

Name of the Vulnerable Software and Affected Versions TypeApp versions 1.9.5.35 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For TypeApp versions...

CVE-2019-12366: Improper Neutralization of Input During Web Page Generation

The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12367: Improper Neutralization of Input During Web Page Generation

The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2020-10566

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow...

CVE-2020-10566

CVE-2020-10566 affects grub2-bhyve used in FreeBSD bhyve prior to revision 525916 (2020-02-12). Affected component is grub2-bhyve’s handling of font loading via a guest grub2.cfg, which leads to a buffer overflow. Multiple sources (NVD, Red Hat advisory, CNVD, CNVD mirrors) corroborate the vulner...

CVE-2020-10566

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow...

CVE-2020-10566: Buffer Copy without Checking Size of Input

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow...

PT-2020-12208

Name of the Vulnerable Software and Affected Versions grub2-bhyve versions prior to revision 525916 2020-02-12 Description The issue is related to the mishandling of font loading by a guest through a grub2.cfg file, leading to a buffer overflow. Recommendations For versions prior to revision 5259...

PowerSploit1

This is a PowerShell module for code execution and antivirus bypass. The module contains several functions, including: 1. Find-AVSignature: This function locates tiny AV signatures using the same method as DSplit from "class101" on heapoverflow.com. 2. Invoke-DllInjection: This function injects a...

Huawei EulerOS: Security Advisory for perl (EulerOS-SA-2020-1196)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.2.0 : perl (EulerOS-SA-2020-1196)

According to the versions of the perl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows...

CVE-2020-0798

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Installer...

Privilege escalation

An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Installer...

Horde Groupware Webmail Edition 5.2.22 PHAR Loading

exploit-phar-loading.py !/usr/bin/env python3 from horde import Horde import requests import subprocess import sys TEMPDIR = '/tmp' WWWROOT = '/var/www/html' if lensys.argv ' sys.exit1 baseurl = sys.argv1 username = sys.argv2 password = sys.argv3 filename = sys.argv4 phpcode = sys.argv5 source =...