CVE-2019-14765

Incorrect Access Control in AfficheExplorateurParam in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers...

Linux kernel memory leak vulnerability (CNVD-2019-41275)

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A memory disclosure vulnerability exists in the nfpflowerspawnvnicreprs function in...

SQL Injection Vulnerability in Seven Bears Library System v3.4

Seven bears is similar to Baidu library, can realize the document sharing, selling library CMS system. After the user uploads the source document, seven bears will automatically transcode the document into HTML, after the success of the document HTML back to the library CMS. to realize...

OPENSUSE-SU-2019:2128-1 Security update for srt

srt was updated to version 1.3.4. Security issues fixed: CVE-2019-15784: avoid a potential array overflow. boo1148844 New binary: srt-tunnel srt-multiplexer binary is now a testing application and thus is dropped from our package. This update was imported from the openSUSE:Leap:15.1:Update update...

PT-2019-11545

Name of the Vulnerable Software and Affected Versions: Linaro/OP-TEE versions prior to 3.4.0 Description: The issue affects the optee os component and can lead to memory corruption of the TEE itself due to boundary crossing. Recommendations: For versions prior to 3.4.0, update to version 3.4.0 or...

CVE-2019-1777

A vulnerability in the web-based interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against another user of the service. The vulnerability is due to insufficient validation of user-supplied input by the...

PT-2019-2130 · Cisco · Cisco Registered Envelope Service

Name of the Vulnerable Software and Affected Versions: Cisco Registered Envelope Service versions 5.3.4.x Description: The issue is related to insufficient validation of user-supplied input by the web-based interface, allowing an attacker to conduct a cross-site scripting XSS attack. This could...

Adobe Shockwave Player Memory Corruption Vulnerability (CNVD-2019-10621)

Adobe Shockwave Player is a multimedia player product from the American company Adobe. The product is able to Adobe Director a multimedia production software produced by the application published to the Internet, installed with the Shockwave plug-in browser can be viewed. A memory corruption...

Bootstrap Cross-Site Scripting Vulnerability (CNVD-2019-23270)

Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript . A cross-site scripting vulnerability exists in affix in Bootstrap versions prior to 3.4.0, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2018-14746

Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to run arbitrary commands on the NAS...

CVE-2018-14749

Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS...

CVE-2018-18744

An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMSMain.php URI...

CVE-2018-18745

An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMSMenu.php?lgid=1 during editing...

CVE-2018-18742

A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMSUser.php?Class=add&CF=user URI...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01724)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. A cross-site scripting vulnerability exists in SEMCMS version 3.4, which can be exploited by remote attackers to inject arbitrary Web script or HTML into the Keywords field of the...

SEMCMS Cross-Site Request Forgery Vulnerability

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 3.4 cross-site request forgery vulnerability exists, remote attackers can use admin/SEMCMSUser.php?Class=add&CF=user URI to perform unauthorized operations...

SV3C L-SERIES HD CAMERA Cross-Site Scripting Vulnerability

SV3C L-SERIES HD CAMERA is a webcam product from SV3C Technology, China. A cross-site scripting vulnerability exists in SV3C L-SERIES HD CAMERA version V2.3.4.2103-S50-NTD-B20170508B, which originates from the program failing to properly validate user-submitted input. The vulnerability can be...

Jirafeau Cross-Site Scripting Vulnerability (CNVD-2018-12870)

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the 'search file by link' form in Jirafeau versions prior to 3.4.1. A remote attacker can use this vulnerability to steal sessions and gain administrative privileges...

Centreon cross-site scripting vulnerability (CNVD-2018-17879)

Centreon is a free and open source IT and application monitoring software. A cross-site scripting vulnerability exists in Centreon version 3.4.6 and Centreon Web version 2.8.23. A remote attacker can exploit this vulnerability to inject a payload into a username or command description...

CVE-2017-13072

Cross-site scripting XSS vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code...