waimai Super Cms Cross-Site Scripting Vulnerability (CNVD-2019-13569)

Waimai Super Cms is a takeaway ordering system. A cross-site scripting vulnerability exists in Waimai Super Cms version 20150505. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side...

PT-2019-18303 · Xiaomi · Xiaomi Mi6 Browser

Name of the Vulnerable Software and Affected Versions: Xiaomi Mi6 Browser versions prior to 10.4.0 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious...

Magento SQL Injection Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A SQL injection vulnerability exists in Magento, which stems from a lack of validation of externally entered SQL...

UKcms Cross-Site Request Forgery Vulnerability

Lingji Network Technology UKcms is a PHP-based content management system CMS by China Lingji Network Technology. A cross-site request forgery vulnerability exists in UKcms v1.1.10, which originates from a WEB application that does not adequately validate whether a request comes from a trusted use...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated. Details Denial of Service DoS...

UBUNTU-CVE-2019-10723

An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated...

GHSA-PMV6-GF98-P3R5 Command Injection in kill-port

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input such as the port number is passed directly to the function. Recommendation Upgrad...

Pivotal Software Pivotal Application Service Information Disclosure Vulnerability

Pivotal Software Pivotal Application Service PAS is a suite of application management software from the American company Pivotal Software. A security vulnerability exists in Pivotal Software PAS versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7, and 2.4.x prior to 2.4.3, which stems from a...

elFinder PHP Connector exiftran Command Injection

This module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is not...

Cisco Nexus 9000 Series Switch Matrix Switch Local Command Injection Vulnerability

The Cisco Nexus 9000 Series switches are modular and fixed-port network switches designed for data centers. A Shell Escape vulnerability exists in the software of the Cisco Nexus 9000 Series ACI mode switches. The vulnerability stems from a failure to validate user-supplied input when issuing...

CVE-2019-0540

A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'...

CVE-2019-6547

Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the software to crash due to lacking user input validation for processing project files...

NVIDIA Windows GPU Display Driver Privilege License and Access Control Issues Vulnerability

The NVIDIA Windows GPU Display Driver is a display driver for Windows systems. A vulnerability exists in the 3D visual component of the NVIDIA Windows GPU display driver. The vulnerability stems from the Stereo Services software not checking for hard links when opening files. An attacker could us...

CVE-2019-5666

CVE-2019-5666 affects the NVIDIA GPU Display Driver (kernel mode nvlddmkm.sys) for Windows and Linux. The issue arises in the DxgkDdiCreateContext path, where untrusted input is used to calculate or reference an array index without proper validation, enabling potential denial of service or privil...

Buffer overflow vulnerability in SGO South satellite navigation platform software

Guangzhou Nanfang Satellite Navigation Instrument Co., Ltd. is subordinate to Nanfang Surveying and Mapping Group, and is the first national high-tech enterprise in China that has passed through the high-precision GNSS technology industry chain and realized large-scale and market-oriented...

PT-2019-18159 · Delta Industrial Automation · Cncsoft Screeneditor

Name of the Vulnerable Software and Affected Versions: Delta Industrial Automation CNCSoft ScreenEditor versions 1.00.84 and prior Description: An out-of-bounds read issue may cause the software to crash due to lacking user input validation for processing project files. This occurs when the...

WSD-T13 Cloud Storage Camera (Android client) suffers from an override access vulnerability (CNVD-2019-06647)

Ltd. is an enterprise specializing in the research and development, production, sales and service of security monitoring products. WSD-T13 Cloud Storage Camera Android client suffers from an overstepping access vulnerability. The vulnerability is due to the server on the client request data...

Oracle Secure Global Desktop Multiple Vulnerabilities (January 2019 CPU)

The version of Oracle Secure Global Desktop installed on the remote host is 5.4 and is missing a security patch from the January 2019 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability exists in Apache HTTP Server 2.4.17 to...

CVE-2018-17684

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17635

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...