CVE-2020-7870

A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to insufficient validation of the parameter...

CVE-2020-7871

A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of the parameter. This issue affects: Cnesty Helpcom 10.0 versions prior to...

CVE-2020-7871

A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of the parameter. This issue affects: Cnesty Helpcom 10.0 versions prior to...

ezPDF buffer error vulnerability

ezPDF is a cell phone PDF reader. It can help users to search for all PDF files in the phone, and can help users quickly open these PDF files to view. There is a security vulnerability in ezPDF that stems from memory corruption caused by insufficient parameter validation. Currently there is no...

Helpcom Input Validation Vulnerability

Helpcom is an application of Helpcom Korea, Inc. which provides remote control services. a security vulnerability exists in Helpcom, which stems from insufficient parameter validation. An attacker could exploit the vulnerability to execute arbitrary commands...

CVE-2020-27339

CVE-2020-27339 affects InsydeH2O kernel 5.x, where several SMM drivers (AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, SdMmcDeviceDxe) fail to validate the CommBuffer and CommBufferSize, allowing memory corruption of firmware or OS memory. The issue is fixed in kernel 5.1–5.5 with specifi...

Cisco Small Business 200 Series Managed Switches: Cross-site Scripting Vulnerabilities

Cisco Small Business 200 Series Managed Switches is a 200 Series managed switch from Cisco, Inc. A cross-site scripting vulnerability exists in Cisco Small Business 220 Series Smart Switches, which stems from improperly checking the value of a parameter on an affected page. An attacker could use...

Cisco Small Business 220 Series Smart Switch Authorization Issues Vulnerability

The Cisco Small Business 220 Series Smart Switches is a small smart switch device from Cisco. An authorization issue vulnerability exists in the Cisco Small Business 220 Series Smart Switches that stems from a lack of parameter validation of TFTP configuration parameters. Exploitation of this...

Crlf injection

A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components...

CVE-2021-1358

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. A...

CVE-2021-1306

A vulnerability in the restricted shell of Cisco Evolved Programmable Network EPN Manager, Cisco Identity Services Engine ISE, and Cisco Prime Infrastructure could allow an authenticated, local attacker to identify directories and write arbitrary files to the file system. This vulnerability is du...

GHSA-H9PX-9VQG-222H Heap OOB in `QuantizeAndDequantizeV3`

Impact An attacker can read data outside of bounds of heap allocated buffer in tf.rawops.QuantizeAndDequantizeV3: python import tensorflow as tf tf.rawops.QuantizeAndDequantizeV3 input=2.5,2.5, inputmin=0,0, inputmax=1,1, numbits=30, signedinput=False, rangegiven=False, narrowrange=False, axis=3...

Cisco Finesse input validation error vulnerability

Cisco Finesse is a next-generation seat and supervisor desktop designed to provide a collaborative experience for the diverse communities that interact with your customer service organization. An open redirection vulnerability exists in the Web management interface of Cisco Finesse 12.61 and...

Google TensorFlow buffer error vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in TensorFlow 2.4.2,2.3.3,2.2.3,2.1.4, which stems from a lack of validation between the parameters tf.rawops.Conv3DBackprop. This results in a heap buffer...

Cisco Unified Communications Manager SQL Injection Vulnerability

Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable, and highly available enterprise IP telephony call processing solution. A SQL injection vulnerability...

CVE-2021-1365

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted...

INIM ELECTRONICS SmartLiving System Code Issues and Vulnerabilities

INIM ELECTRONICS SmartLiving System is an application of the Italian company INIM ELECTRONICS. A SmartLiving System. A security vulnerability exists in INIM ELECTRONICS SmartLiving System, which stems from a lack of validation of parameters, and can be exploited by an attacker to specify an...

Design/Logic Flaw

An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarcversion aka oauthregisteredconsumer.oarcversion parameter's length...

Design/Logic Flaw

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perfor...

CVE-2021-29431

Sydent (Matrix identity server) is affected by a SSRF issue caused by missing validation of hostnames, allowing the server to be induced to issue HTTP GETs to internal systems. The impact is described as not enabling data exfiltration or control of request headers, but it may enable internal port...