490 matches found
CVE-2020-14155
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a ?C substring...
CVE-2020-14155: Integer Overflow or Wraparound
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a ?C substring...
CVE-2020-14155
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a ?C substring...
CVE-2020-12283
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring...
PT-2020-20562
Name of the Vulnerable Software and Affected Versions SoPlanning version 1.45 Description The issue concerns SQL Injection in the OrderBy clause. This is demonstrated through the projets.php endpoint with specific parameters, such as order=nom createur and by=substring. Recommendations For...
PT-2020-6932 · Pcre +11 · Pcre +11
Name of the Vulnerable Software and Affected Versions: PCRE versions prior to 8.44 Description: The issue is related to an integer overflow in the libpcre component of the PCRE library, which can be triggered by a large number after a C substring. This can allow a remote attacker to cause a denia...
CVE-2019-20041
wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript substring...
CVE-2019-20041
wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring...
CVE-2019-17119
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter...
PT-2019-14957
Name of the Vulnerable Software and Affected Versions WiKID 2FA Enterprise Server versions through 4.2.0-b2053 Description The issue allows authenticated users to execute arbitrary SQL commands via the source or subString parameter in Logs.jsp. This can lead to unauthorized data access and...
CVE-2019-17119: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter...
CVE-2019-17373
Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2...
PT-2019-15112
Name of the Vulnerable Software and Affected Versions NETGEAR devices versions MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, WNR834Bv2 Description The issue allows unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg. Thi...
CVE-2019-17373: Undefined Security Weakness
Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2...
Directory Traversal
Butor Portal is vulnerable to path traversal. Lack of validation on user provided path via the theme t parameter allows an attacker to to inject malicious substring /wl?t=../../...= followed by a filename to get access to the file...
DEBIAN-CVE-2019-16707
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx...
CVE-2019-16132
An issue was discovered in OKLite v1.2.25. framework/admin/tplcontrol.php allows remote attackers to delete arbitrary files via a title directory-traversal pathname followed by a crafted substring...
PT-2019-14453
Name of the Vulnerable Software and Affected Versions profilegrid-user-profiles-groups-and-communities plugin versions prior to 2.8.6 Description The issue allows for remote code execution. This can be achieved through a request to the wp-admin/admin-ajax.php endpoint with specific parameters,...
Cisco Integrated Management Controller Privilege Escalation
The vulnerability of the Cisco Integrated Management Controller, a software-based remote server management system, is related to errors in processing substring comparisons. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially crafted HTTP request...