Advantech WebAccess RtspVapgDecoderNew2 SetPaybackFilePath Stack Buffer Overflow Remote Code Execution Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow remote code execution vulnerabilit...

Advantech WebAccess nvA1Media Connect MediaUsername Stack Buffer Overflow Remote Code Execution Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow remote code execution vulnerabilit...

Advantech WebAccess nvA1Media Connect MediaPassword Stack Buffer Overflow Remote Code Execution Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. A stack buffer overflow remote code execution vulnerabilit...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

Cross site scripting

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

Flash Slideshow Maker Professional XSS / Content Forgery / Redirect

================================================================================= | | | | | | | | | | | |/' | / / / / | ' | /| | ' \ \ / | '| \ \ \ /\ / / | | | \ |/ / | | | | |./ / | | ./ /\ V V / || ||/|| || ||/ || / // C O N T A C T : Twitter: @ret2eax Email: [email protected] Blog:...

Cross-Site Scripting in PAN-OS

A vulnerability exists in the PAN-OS GlobalProtect external interface that could allow for a cross-site scripting XSS attack. PAN-OS does not properly validate specific request parameters. Ref PAN-77294 / CVE-2017-9467 Successful exploitation of this issue may allow an attacker to inject arbitrar...

Heap Overflow Vulnerability in WPS

WPS is an office software developed by Kingsoft Office Software. A heap overflow vulnerability exists in WPS text. The vulnerability is due to the program fails to validate the buffer length, an attacker can exploit the vulnerability by constructing a malformed XML file resulting in heap corrupti...

The vulnerability of the RW-message structure in the Aerospike Database Server of the Oracle Database database management system allows a perpetrator to execute arbitrary code.

The vulnerability of the RW-message structure in the Aerospike Database Server of the Oracle Database database management system is related to unvalidated array indexing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code read from beyond the memory limit using a...

Trello: Unpatched (https://hackerone.com/reports/221928)- Unviladate File Upload to XSS on trello-attachment Bucket

Report no: https://hackerone.com/reports/221928 is unpatched. Poc: https://trello-attachments.s3.amazonaws.com/59663070a9025afc4b32c7c6/596641e05abfc29b1bd67ff8/9c5258c6acf27ffdf5e80d5bfabbb83b/lol.svg XSS Link...

The vulnerability of the TrustZone component of the Android operating system allows a hacker to gain access to information.

The vulnerability of the TrustZone component in the Android operating system is related to unvalidated array indexing. Exploiting this vulnerability can allow a remote attacker to gain access to sensitive information...

chromium-browser: possible command injection in mailto handling

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

Memory out-of-bounds access vulnerability in WPS text kso module

WPS is an office software developed by Kingsoft Office Software. A memory out-of-bounds access vulnerability exists in the WPS text kso module. The vulnerability is caused by the program failing to validate the buffer length and calling wcslen directly, which could be exploited by an attacker to...

Command Execution Vulnerability in seacms Backend

seacms is a video-on-demand system based on PHP+MySql technology. His message board cms/gbook.php has a backend command execution vulnerability due to the system not validating incoming content. An attacker is allowed to exploit this vulnerability to execute arbitrary commands...

Pivotal RabbitMQ Cross-Site Scripting Vulnerability

Pivotal RabbitMQ, etc. are products of Pivotal Software, USA. A cross-site scripting vulnerability exists in Pivotal RabbitMQ due to the program failing to adequately validate user input. An attacker could exploit this vulnerability to execute arbitrary script code on the browser of a user on an...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

PT-2017-4654

CVE-2025-14715 - CVE-2008-4251: Adobe Flash Player Unvalidated Redirects CVE ID : CVE-2025-14715 Published : Dec. 25, 2025, 11:15 p.m. | 2 hours, 10 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the...

DEBIAN-CVE-2017-0350

All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of service or potential escalation of privileges...

Code injection

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...