jackson-mapper-asl: XML external entity similar to CVE-2016-3720

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity XXE vulnerability affects codehaus's jackson-mapper-asl libraries. This vulnerability is similar to CVE-2016-3720. The primary threat from this flaw is data integrity...

Zephyr Code Execution Vulnerability (CNVD-2020-35962)

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. A security vulnerability exists in the MQTT packet length decoder in Zephyr 2.2.0 and later versions fixed in version 2.3.0. An attacker could exploit this vulnerability to cause memory corruption and...

QEMU Buffer Overflow Vulnerability (CNVD-2020-35975)

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A buffer overflow vulnerability exists in the hw/pci/pci.c file in QEMU version 4.2.0. The vulnerability stems from a network...

FreeRDP Buffer Overflow Vulnerability (CNVD-2020-31430)

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. A buffer overflow vulnerability exists in FreeRDP 2.0.0 and prior versions, which stems from the program reading an invalid array index when the logger is set to 'WLOGTRACE'. An attacker can exploit...

DEBIAN-CVE-2020-11017

In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0...

Ubiquiti Networks AirOS Operating System Command Injection Vulnerability

Ubiquiti Networks AirOS is a suite of operating systems for Ubiquiti network devices from Ubiquiti Networks. A command injection vulnerability exists in Ubiquiti Networks AirMax AirOS TI, XW, and XM boards using firmware version 6.2.0 and earlier. A remote attacker could exploit the vulnerability...

Ubiquiti Networks AirOS Cross-Site Scripting Vulnerability

Ubiquiti Networks AirOS is a suite of operating systems for Ubiquiti network devices from Ubiquiti Networks. A cross-site scripting vulnerability exists in Ubiquiti Networks AirMax AirOS TI, XW, and XM boards using firmware version 6.2.0 and earlier. An attacker could exploit the vulnerability to...

DEBIAN-CVE-2020-12872

yawsconfig.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0...

PT-2020-10763 · Trustwave +1 · Opendmarc +1

Name of the Vulnerable Software and Affected Versions: OpenDMARC versions 1.3.2 and 1.4.x Description: The issue allows attacks to bypass SPF and DMARC authentication when the HELO field is inconsistent with the MAIL FROM field, specifically when OpenDMARC is used with pypolicyd-spf 2.0.2...

PT-2020-6230 · Libslirp +8 · Libslirp +8

Name of the Vulnerable Software and Affected Versions: libslirp versions 4.2.0 and prior releases Description: The issue is related to a use after free vulnerability in the ip reass function in ip input.c of the libslirp library. This vulnerability can be exploited by crafted packets, leading to ...

Oracle Virtualization VM VirtualBox Unauthorized Operation Vulnerability

Oracle Virtualization is a set of virtualization solutions from Oracle Corporation. The product is used to unify the management of the entire hardware and software system from applications to disks, enabling virtualization from the desktop to the data center.VM VirtualBox is one of the virtual...

Plat'Home EasyBlocks IPv6 Authorization Issues Vulnerability

Plat'Home EasyBlocks IPv6 is an IPv6 address set allocation unit product from Plat'Home Japan. An authorization issue vulnerability exists in Plat'Home EasyBlocks IPv6 version 2.0.1 and earlier Enterprise Edition and version 2.0.1 and earlier. The vulnerability can be exploited by an attacker to...

Dell EMC Isilon OneFS Access Control Error Vulnerability

Dell EMC Isilon OneFS is a horizontally scalable storage system for unstructured data from Dell USA. An access control error vulnerability exists in Dell EMC Isilon OneFS versions prior to 8.2.0. The vulnerability arises from the network system or product not properly restricting access to...

VideoLAN VLC Media Player Cross-Site Scripting Vulnerability (CNVD-2020-08120)

VideoLAN VLC media player is a free, open source cross-platform multimedia player also a multimedia framework organized by VideoLAN France. The product supports the playback of a variety of media files, CD-ROMs, etc., a variety of audio and video formats WMV, MP3, etc. and so on. A cross-site...

CVE-2020-5521

The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2020-18487

Name of the Vulnerable Software and Affected Versions PHPGurukul Hostel Management System version 2.0 Description The issue allows SQL injection via the id parameter in the "full-profile.php" file. This could potentially be exploited to extract or modify sensitive data. Recommendations For...

IceWarp WebMail Server Cross-Site Scripting Vulnerability

IceWarp WebMail Server is a Web-based mail server product from the U.S. company IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in IceWarp WebMail Server version 12.2.0 and version 12.1.x prior to...

Cisco DNA Spaces:Connector Input Validation Error Vulnerability

Cisco DNA Spaces is a set of indoor location services platform from Cisco.Cisco DNA Spaces:Connector is one of the connectors used to support the communication of Cisco wireless controllers. An input validation error vulnerability exists in versions prior to Cisco DNA Spaces: Connector 2.0, which...

Broadcom Brocade SANnav Information Disclosure Vulnerability (CNVD-2019-41466)

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in the authentication mechanism in Broadcom Brocade SANnav versions prior to 2.0. A local attacker could exploit this vulnerability to access sensitive information...

SQL Injection Vulnerability in Kaixin Quote System V2.0 da***.aspx Page

The QI Quotation System is primarily for use by manufacturing companies. For incoming BOM list price monitoring. The system will automatically record the past quoted prices of BOM products, so that the purchasing staff can easily give new quotes. A SQL injection vulnerability exists in the Qixing...