The vulnerability of the jp2image.cpp component in the Exiv2 metadata management library allows a attacker to cause a service failure.

The vulnerability of the jp2image.cpp component in the Exiv2 metadata management library is related to incorrect error handling. Exploiting this vulnerability may allow a malicious actor to trigger a service failure SIGABRT by calling the Safe::add function remotely...

CVE-2019-19197

IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402401 using METHODNEITHER results in a read primitive...

httpd: mod_http2: read-after-free on a string compare

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly...

httpd: mod_http2: read-after-free on a string compare

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly...

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

Input validation

The Tecno Camon iClick 2 Android device with a build fingerprint of TECNO/H622/TECNO-ID6:8.1.0/O11019/F-180824V116:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

CVE-2019-15348

The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service named...

Siemens S7-1200 and S7-200 SMART CPUs (Update B)

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Low skill level to exploit Vendor : Siemens Equipment: S7-1200 CPU family including SIPLUS variants; S7-200 SMART CPU family Vulnerability : Exposed Dangerous Method or Function 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory...

Cross-site Scripting (XSS)

activemq-http is vulnerable to cross-site scripting XSS. The vulnerability exists as the value of clientID was not sanitized in createTransportChannel and stopped of HttpTunnelServlet.java...

CVE-2008-7291

gri before 2.12.18 generates temporary files in an insecure way...

Rockwellautomation 1763-l16awa Exposure of Sensitive Information to an Unauthorized Actor

An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00...

python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib

A flaw was found in the way catastrophic backtracking was implemented in python's pop3lib's apop method. An attacker could use this flaw to cause denial of service...

DEBIAN-CVE-2013-4412

slim has NULL pointer dereference when using crypt method from glibc 2.17...

CVE-2013-4412

slim has NULL pointer dereference when using crypt method from glibc 2.17...

CVE-2013-4412

slim has NULL pointer dereference when using crypt method from glibc 2.17...

Design/Logic Flaw

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2019-17325

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a...

GHSA-MX7P-6679-8G3Q Polymorphic Typing in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled either globally or for a specific property for an externally exposed JSON endpoint and the service has the commons-dbcp 1.4 jar in the classpath, and an attacker can find a...

SQL injection vulnerability in the de*** method of the ad***_ne***.php file in the backend of seacms

seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adne.php file de method exists SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...

SQL injection vulnerability in ad***_jq***.php file de*** method in seacms backend

seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adjq.php file de method there is a SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information...