Microsoft SharePoint Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint...

DEBIAN-CVE-2020-6443

Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page...

UBUNTU-CVE-2020-6431

Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted HTML page...

UBUNTU-CVE-2020-6444

Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the security interface of Google Chrome’s pop-up blockers allows attackers to compromise data integrity.

The vulnerability of the security interface of Google Chrome’s pop-up blockers is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise data integrity through a specially created HTML page...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Advantech WebAccess/NMS Input Validation Error Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. An input validation error vulnerability exists in Advantech WebAccess/NMS, which can be exploited by an attacker to obtain sensitive information via specially crafted XML input...

CVE-2019-4391

HCL AppScan Standard is vulnerable to XML External Entity Injection XXE attack when processing XML data...

Django: the behavior of the underlying HTMLParser leading to DoS

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...

DEBIAN-CVE-2020-10960

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...

CVE-2019-9163

The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects...

chromium-browser: Use after free in audio

Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Google Chrome memory misreference vulnerability (CNVD-2020-19204)

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A memory misreference vulnerability exists in audio in versions prior to Google Chrome 80.0.3987.149. A remote attacker can exploit this vulnerability to leverage...

CVE-2019-12123

An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary command. All SDC setups that include admportal are affected...

The vulnerability of the RDP connection manager, Remote Desktop Connection Manager (RDCMan), related to improper processing of XML data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the RDP connection manager, Remote Desktop Connection Manager RDCMan, is related to incorrect processing of XML data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using a file with the RDG...

bima.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1117089 Security Researcher g0bl1nsec Helped patch 3759 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bima.co.uk website and it...

WAGO PFC200 Command Injection Vulnerability (CNVD-2020-16840)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A command injection vulnerability exists in the iocheckd service 'I/O-Check' function of the WAGO PFC200 03.02.0214. An attacker can exploit this vulnerability to inject OS commands via specially crafted XML cache files...

WAGO PFC200 Stack Buffer Overflow Vulnerability (CNVD-2020-16852)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A stack buffer overflow vulnerability exists in the iocheckd service 'I/O-Check' function of the WAGO PFC200 03.02.0214. An attacker could exploit this vulnerability via a specially crafted XML cache file to achieve code...

WAGO PFC200 Command Injection Vulnerability (CNVD-2020-16848)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A command injection vulnerability exists in the iocheckd service 'I/O-Check' function of the WAGO PFC200 03.02.0214. An attacker can exploit this vulnerability to inject OS commands via specially crafted XML cache files...

Siemens SiNVR 3 Insufficient Records Vulnerability

SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 has an insufficient security operation logging vulnerability in the XML-based communication protocol implementation, which can be exploited by a remote...