WordPress link-log plugin injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. link-log is a plugin used to store a log of external link clicks. An injection vulnerability exists in WordPress link-log plugin...

CVE-2019-15666

An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in xfrmpolicyunlink, which will cause denial of service, because verifynewpolicyinfo in net/xfrm/xfrmuser.c mishandles directory validation...

SUSE-SU-2019:2091-1 Security update for python

This update for python fixes the following issues: - CVE-2019-10160: Fixed a regression in urlparse and urlsplit introduced by the fix for CVE-2019-9636 bsc1138459. - CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation...

Adobe Acrobat Pro DC AcroForm value Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling ...

PT-2019-16570 · Zte · Zxhn F670

Name of the Vulnerable Software and Affected Versions: ZTE ZXHN F670 product versions up to V1.1.10P3T18 Description: The issue is related to a cross-site scripting vulnerability XSS due to incomplete input validation. An authorized user can exploit this to execute malicious scripts...

UNA Cross-Site Scripting Vulnerability

UNA is a full-stack software platform for building custom community websites, social networks and collaboration centers. A cross-site scripting vulnerability exists in studio/buildermenu.php?page=sets in UNA version 10.0.0-RC1, which stems from a lack of proper validation of client-side data in t...

webkitgtk: arbitrary code execution via malicious web content

A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of process memory...

EspoCRM Cross-Site Scripting Vulnerability (CNVD-2019-24800)

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A cross-site scripting vulnerability exists in EspoCRM version 5.6.4. The vulnerability stems from the WEB application lacking...

CVE-2019-14212

An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling certain XFA JavaScript due to the use of, or access to, a NULL pointer without proper validation on the object...

Cisco Industrial Network Director Encryption Issue Vulnerability

Cisco Industrial Network Director IND is an industrial automation management system from Cisco. The system achieves automation management by visualizing the industrial Ethernet infrastructure. A cryptographic issue vulnerability exists in the Web Services Management Agent WSMA feature in Cisco IN...

CVE-2019-3571

An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension...

Eventum Cross-Site Scripting Vulnerability (CNVD-2019-39386)

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site scripting vulnerability exists in the /htdocs/validate.php file in Eventum version 3.5.0. The vulnerability stems from a lack of proper validation of client-si...

WordPress miniOrange SAML SP Single Sign On Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. miniOrange SAML SP Single Sign On plugin is a single sign on plugin used in it. A cross-site scripting vulnerability exists in the SAM...

CVE-2018-15913

An issue was discovered in Cloudera Manager 5.x through 5.15.0. One type of page in Cloudera Manager uses a 'returnUrl' parameter to redirect the user to another page in Cloudera Manager once a wizard is completed. The validity of this parameter was not checked. As a result, the user could be...

Symfony Authentication Bypass Vulnerability (Jul 2017)

Symfony is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sensiolabs:symfony"; ...

Inateck Technology WP1001 Data Forgery Issue Vulnerability

The Inateck Technology WP1001 is a wireless presentation remote control from Inateck Technology, USA. A vulnerability exists in the Inateck Technology WP1001 v1.3C for data forgery issues. The vulnerability arises from a networked system or product that does not adequately validate the origin or...

HPE Intelligent Management Center Remote Code Execution Vulnerability (CNVD-2019-24782)

HPE Intelligent Management Center is a suite of network intelligence management center solutions. The solution provides network-wide visibility and enables comprehensive management of resources, services and users. A code execution vulnerability exists in the handling of the 'beanName' parameter ...

Apple Safari WebDataListSuggestionPicker Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2018-12012

While updating blacklisting region shared buffered memory region is not validated against newly updated black list, causing boot-up to be compromised in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrago...

Computrols CBAS Web Cross-Site Scripting Vulnerability

Computrols CBAS is a building automation system from Computrols USA. A cross-site scripting vulnerability exists in Computrols CBAS Web. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute...