GHSA-QPRX-Q2R7-3RX6 Improper Input Validation in Apache Tomcat

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a...

CVE-2021-0126

Improper input validation for the IntelR Manageability Commander before version 2.2 may allow an authenticated user to potentially enable escalation of privilege via adjacent access...

Online Sports Complex Booking System SQL注入漏洞

Online Sports Complex Booking System is an online stadium booking system by Carlo Montero, a personal developer. page=user/manageuser&id= lacks validation of external input SQL statements, which can be exploited to execute illegal SQL commands to steal sensitive database data...

AMD System Management Mode 数据伪造问题漏洞

AMD System Management Mode is a system management mode from AMD in the United States. It is a CPU execution mode. A security vulnerability exists in AMD System Management Mode that stems from a failure to validate a protocol in SMM, which could allow an attacker to take control of the protocol an...

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

The vulnerability of the Core component of the Oracle Coherence data processing software allows a hacker to execute arbitrary code.

The vulnerability of the Core component of the Oracle Coherence data processing software exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

php: SSRF bypass in FILTER_VALIDATE_URL

A flaw was found in php. Currently, php's FILTERVALIDATEURL check doesn't recognize some non-compliant RFC 3986 URLs and returns them as valid. This flaw allows an attacker to craft URLs, which depending on how the URL filter checking is used on the application side, lead to Server Side Request...

ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i()

The ntfs3g package is susceptible to an input validation flaw. When processing a crafted NTFS image there is an improper check which leads to an out of bounds read. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

ntfs-3g: Out-of-bounds read in ntfs_ie_lookup()

The ntfs3g package is susceptible to an input validation flaw. When processing a crafted NTFS image there is an improper check which leads to an out of bounds read. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

CVE-2022-30233

A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing certain actions on a webpage. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...

Adobe InDesign 缓冲区错误漏洞

A security vulnerability exists in Adobe InDesign, a set of typesetting and editing applications from Adobe. The vulnerability stems from a networked system or product that does not properly validate data boundaries when performing operations on memory, and can be exploited by an attacker to...

CVE-2022-24098

Adobe Photoshop versions 22.5.6 and earlierand 23.2.2 and earlier are affected by an improper input validation vulnerability when parsing a PCX file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a...

Vulnerability of the Server component: The Replication function of the MySQL Server database management system, which allows attackers to trigger an emergency shutdown.

The vulnerability of the MySQL Server database management system’s replication component exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger an emergency shutdown through network packets...

Vulnerability of the Cluster component: The general database management system of Oracle MySQL Cluster allows a hacker to gain full control over the application.

Vulnerability of the Cluster component: The general system for managing databases in Oracle MySQL Cluster is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to gain full control over the application through various network protocols...

CVE-2022-20753

A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit...

CVE-2022-20753

A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit...

CVE-2022-22433

IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrar...

arPHP 跨站脚本漏洞

arPHP is a tool that enables Arabic web developers to provide search, presentation and processing of Arabic content in PHP. arPHP version 3.6.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output in Query.php. ...

CVE-2022-28783

Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permission. The patch adds proper validation logic for removing package name...

Cyclos 4 PRO 跨站脚本漏洞

Cyclos 4 PRO is a web server. a cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which stems from a failure to validate user input during error notification. A remote, unauthenticated attacker could execute javascript code via undefine enumeration constants...