PYSEC-2019-79

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

UBUNTU-CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

CVE-2019-10048

The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying...

Vtiger CRM SQL Injection Vulnerability (CNVD-2019-16507)

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A SQL injection vulnerability exists in the...

Doxygen Cross-Site Scripting Vulnerability

Doxygen is a documentation generator for several programming languages. A cross-site scripting vulnerability exists in the templates/html/searchopensearch.php file in Doxygen. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

PT-2019-4622

Name of the Vulnerable Software and Affected Versions Django versions 1.11 through 1.11.20 Django versions 2.1 through 2.1.8 Django versions 2.2 through 2.2.1 Description The issue is related to the AdminURLFieldWidget function in the Django web development framework, which is associated with...

Intel i915 Graphics Kernel Mode Driver Input Validation Error Vulnerability

Intel i915 Graphics is a set of graphics card drivers from Intel Corporation.Kernel Mode Driver is one of the kernel mode drivers. An input validation error vulnerability exists in the Intel i915 Graphics Kernel Mode Driver. The vulnerability arises from a networked system or product that does no...

CommSy SQL Injection Vulnerability

Commsy is a Web-based, open source community system for project management. A SQL injection vulnerability exists in CommSy version 8.6.5. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerabili...

Microsoft Windows Jet Database Engine Buffer Overflow Vulnerability (CNVD-2019-24832)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Jet Database Engine is one of the database engines. A buffer overflow vulnerabilit...

CVE-2018-12301

Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or localhost...

Suricata Buffer Overflow Vulnerability

Suricata is a set of network intrusion detection system IDS, intrusion prevention system IPS and network security monitoring engine developed by the Open Information Security Foundation OISF and its supported vendors, which supports multi-threading, built-in IPv6, and the ability to load...

OpenProject SQL Injection Vulnerability

OpenProject is an open source Web-based project management software . The software has project planning , task management , bug tracking and cost budgeting and other functions . A SQL injection vulnerability exists in OpenProject versions 5.0.0 through 8.3.1. The vulnerability stems from a lack o...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in OX Software GmbH App Suite 7.8.4 and earlier versions. The...

Cross-site Scripting (XSS)

OpenStack Dashboard horizon provides administrators and users with a graphical interface to access, provision, and automate cloud-based resources. A cross-site scripting XSS flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform...

libpng buffer overflow vulnerability (CNVD-2019-13088)

libpng is a PNG reference library that can create, read and write PNG graphics files. A buffer overflow vulnerability exists in the 'contrib/pngminus/pnm2png.c:gettoken' function in libpng, which originates when a networked system or product performs an operation in memory without properly...

Foxit Studio Photo Remote Code Execution Vulnerability (CNVD-2019-12135)

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A security vulnerability exists in the handling of EZI files in Foxit Studio Photo 3.6.6.779 and prior versions, which arises from the program failing to properly validate user-submitted input. An attacker...

Stage File Proxy - Less critical - Denial of Service - SA-CONTRIB-2019-044

Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate requested urls, allowing an attacker to send repeated requests for files that do not exist which could exhaust resources on the server where Stage File...

PT-2019-18309 · Foxit · Foxit Studio Photo

Name of the Vulnerable Software and Affected Versions: Foxit Studio Photo version 3.6.6 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The...

Fortinet FortiSandbox Cross-Site Scripting Vulnerability (CNVD-2019-13555)

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A cross-site scripting vulnerability exists in Fortinet FortiSandbox versions...

GPAC Buffer Overflow Vulnerability (CNVD-2019-13567)

GPAC is an open source multimedia framework. A buffer error vulnerability exists in gfbin128parse in the utils/osdivers.c file in GPAC version 0.7.1. The vulnerability stems from a networked system or product performing operations in memory without properly validating data boundaries, resulting i...