D-Link Central WiFi Manager (CWM-100) Arbitrary SQL Command Query Vulnerability

D-Link Central WiFi Manager CWM-100 is a Web-based wireless access point management tool. An arbitrary SQL command query vulnerability exists in D-Link Central WiFi Manager CWM-100 versions prior to 1.03R0100BETA6. The vulnerability stems from a failure to validate input. An attacker can exploit...

CVE-2019-11409

app/operatorpanel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when...

FusionPBX Operator Panel module cross-site scripting vulnerability (CNVD-2019-40060)

FusionPBX is a scalable, multi-threaded communication platform. The platform can be used as a call center server, fax server, voip server, voicemail server, conference server and voice application server, etc. Operator Panel module is one of the operator panel modules. The platform can be used as...

IBM Intelligent Operations Center and IBM Water Operations for Waternamics File Upload Vulnerability

IBM Intelligent Operations Center IOC and IBM Water Operations for Waternamics are both products of IBM Corporation, U.S.A. IBM Intelligent Operations Center is a suite of city operations solutions. IBM Intelligent Operations Center is a suite of city operations solutions with features such as da...

Sandbox Breakout / Arbitrary Code Execution

Overview All versions of value-censorship are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. Recommendation No fix is currently available. Consider using an alternative package...

CVE-2019-0885

A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'...

Information Disclosure

miniupnpc-vc140 is vulnerable to information disclosure. Failure to validate a return value obj-tosend from snprintf allows a user to send a value larger than the buffer's length to cause a heap memory leak...

KB4499158: Windows Server 2012 May 2019 Security Update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

The remote Windows host is missing security update 4499158 or cumulative update 4499171. It is, therefore, affected by multiple vulnerabilities : - A new subclass of speculative execution side channel vulnerabilities, known as Microarchitectural Data Sampling, exist in Windows. An attacker who...

DEBIAN-CVE-2019-10050

A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control...

Remote Code Execution in extension "ImageOptimizer" (imageoptimizer)

The extension fails to validate arguments passed to a shell command resulting in Remote Code Execution. The issue is only exploitable, if an attacker is able to upload files directly e.g. SFTP or FTP to the filesystem...

Foxit Studio Photo Remote Code Execution Vulnerability (CNVD-2019-12138)

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A security vulnerability exists in the handling of EZI files in Foxit Studio Photo 3.6.6.779 and prior versions, which arises from the program failing to properly validate user-submitted input. An attacker...

BSA-2019-777

Security Advisory ID : BSA-2019-777 Component : WPA3 Revision : 1.0: Final Multiple vulnerabilities have been identified in WPA3 protocol design and implementations ofhostapdandwpasupplicant, which can allow a remote attacker to acquire a weak password, conduct a denial of service, or gain comple...

CVE-2019-0764

A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerability'...

Denial of service

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0690, CVE-2019-0695...

CVE-2019-0690

A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0695, CVE-2019-0701...

CVE-2019-1753

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to a failure to validate and sanitize input in Web Services Management Agent WSMA...

Foxit Reader and PhantomPDF Information Disclosure Vulnerability (CNVD-2019-08304)

Foxit Reader for Windows is China's Foxit Foxit software company's a Windows-based platform for PDF document reader. PhantomPDF for Windows is its commercial version. An information disclosure vulnerability exists in the processing of the AFParseDateEx method in Foxit Reader 9.3.0.10826 and earli...

SAP J2EE Engine Cross-Site Scripting Vulnerability

SAP J2EE Engine is a set of runtime environments for J2EE applications. A cross-site scripting vulnerability exists in SAP J2EE Engine due to the failure of SAP J2EE Engine/7.01/Portal/EPP to effectively validate or filter user-entered data, resulting in cross-site scripting in the "ctcprotocol"...

CVE-2019-6565

Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script...

CVE-2018-0482

A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient...