The vulnerability of the Evince document viewing software lies in its inability to eliminate special elements, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the Evince document viewing software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a perpetrator to execute arbitrary commands...

CVE-2020-11494

A flaw was discovered in slcbump in drivers/net/can/slcan.c in CAN Communication Protocol. It allows a local attacker with special user privilege or root to read sensitive kernel stack information considering CONFIGINITSTACKALL is not enabled when a partially initialized data structure is exposed...

CVE-2019-19500

Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...

Design/Logic Flaw

Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...

CVE-2019-19500

Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software...

Flush Demo Special Edition suffers from dll hijacking vulnerability

Flush simulation stock speculation special edition is a real simulation stock speculation software trading system. Flush simulation special version of the existence of dll hijacking vulnerability, an attacker can use the vulnerability to execute arbitrary code...

Matrix42 Workspace Management 9.1.2.2765 Cross Site Scripting Vulnerability

Matrix42 Workspace Management version 9.1.2.2765 suffers from a persistent cross site scripting vulnerability. Matrix42 Workspace Management 9.1.2.2765 – Stored Cross-Site Scripting =============================================================================== Identifiers...

openSUSE Security Update : ansible (openSUSE-2020-513)

This update for ansible to version 2.9.6 fixes the following issues : Security issues fixed : - CVE-2019-14904: Fixed a vulnerability in solariszone module via crafted solaris zone boo1157968. - CVE-2019-14905: Fixed an issue where malicious code could craft filename in nxosfilecopy module...

U.S. Dept Of Defense: Stored XSS via 64(?) vulnerable fields in ███ leads to credential theft/account takeover

Summary: A user is able to complete a ████████ worksheets via https://██████████. This form allows a user to store multiple XSS payloads within, which will in turn allow the attacker to run malicious code in context of the legal personnel who view the request. Impact The attacker can have multipl...

The vulnerability of the IGMPv3 protocol in real-time operating systems like Wind River VxWorks allows a hacker to access confidential information.

The vulnerability of the IGMPv3 protocol in real-time operating systems like Wind River VxWorks involves exposing IGMP information through a special report. Exploiting this vulnerability can allow attackers to access confidential information...

CVE-2020-9521

CVE-2020-9521 affects Micro Focus Service Manager Automation (SMA). The vulnerability is an SQL Injection caused by improper neutralization of special elements in SQL commands, impacting SMA versions 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2018.02. The connected records confirm the issue and...

CVE-2020-9431

A memory leak was discovered in Wireshark in the LTE RRC dissector. This issue allows an attacker to trigger the flaw by injecting special packets onto the wire or by convincing a victim user into opening a malformed packet trace file...

Denial Of Service (DoS)

github.com/buger/jsonparser is vulnerable to denial of service. A call to function Delete may cause infinite loop due to inadequate validation for special characters...

Cross-site Scripting (XSS)

actionview is vulnerable to cross-site scripting XSS. Inadequate sanitization and escaping of special characters such as dollar signs and backticks allows an attacker to inject and execute arbitrary Javascript in a user's browser via the j or javascriptescape helper...

The vulnerability of the REMOTE_PORT component of the D-Link DIR-859 router’s microprogramming system exists due to the failure to take measures to neutralize specific elements used in the operating system commands. This vulnerability allows a hacker to execute arbitrary commands.

The vulnerability of the REMOTEPORT component of the D-Link DIR-859 router’s microprogramming system exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

Huawei OxfordS-AN00A Information Disclosure Vulnerability

The Huawei OxfordS-AN00A is a Huawei smartphone device. The Huawei OxfordS-AN00A suffers from an insufficient forensics vulnerability that can be exploited by a remote attacker to submit a special application request, which can be used to obtain sensitive information...

The vulnerability of the Linux operating system’s kernel exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary code.

The vulnerability of the Linux operating system’s kernel exists because measures to neutralize special elements used in the operating system commands have not been implemented. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Command injection

An issue was discovered in Poly formerly Polycom HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By...

WAGO PFC200 Command Injection Vulnerability (CNVD-2020-16847)

The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. A command injection vulnerability exists in the I/O-Check function of the iocheckd service in the WAGO PFC200. The vulnerability arises from a network system or product not properly filtering special characters, commands,...

CVE-2019-19277

A vulnerability has been identified in SIPORT MP All versions 3.1.4. Vulnerable versions of the device allow the creation of special accounts "service users" with administrative privileges that could enable a remote authenticated attacker to perform actions that are not visible to other users of...