FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-47028)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in the app/fax/faxfiles.php file in FusionPBX...

Moodle cross-site scripting vulnerability (CNVD-2019-43885)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle, which stems from the lack of proper validation of client-side data in the WEB...

CVE-2019-0070 Junos OS: NFX Series: An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions.

An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of other portions of the NFX platform they should not be able to access, and execute commands outside their authorized scope of control. This leads to the attacker being able to ta...

The vulnerability of the traffic filtering component of the Cisco SD-WAN programmable network allows a hacker to bypass the filters at the L2 and L4 levels.

The vulnerability of the Cisco SD-WAN’s programmatically defined traffic filtering component exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to bypass L2 and L4 filters using a specially crafted TCP packet...

PT-2019-4386 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.851 Description: The issue allows an attacker to delete a victim's e-mail account via an attacker account due to an insecure object reference. This is caused by insufficient input validation, which can be...

CVE-2019-12632

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery SSRF attack on an affected system. The vulnerability exists because the affected system does not properly validate user-supplied input. An attacker...

cPanel cross-site scripting vulnerability (CNVD-2019-26167)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in cPanel versions prior to 74.0.0. The vulnerability stems from a lack of proper...

The vulnerability of Cisco Email Security Appliance’s security systems, which stems from insufficient validation of input data, allows attackers to bypass the configured content filters and compromise the integrity of the protected information.

The vulnerability of Cisco Email Security Appliance’s security systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass the configured content filters and compromise the integrity of the protected information...

Nortek Security & Control Linear eMerge E3-Series Cross-Site Request Forgery Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control system from Nortek Security & Control, USA. A cross-site request forgery vulnerability exists in the Nortek Security & Control Linear eMerge E3-Series, which arises from a WEB application that does not adequately validate...

The vulnerability of the Hyper-V hardware virtualization system in the Windows operating system allows a hacker to trigger a service failure.

The vulnerability of the Hyper-V hardware virtualization system in the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created application...

SAP R/3 Enterprise Application Cross-Site Scripting Vulnerability

SAP R/3 Enterprise Application is the German SAP SAP company's set of enterprise resource planning ERP software. A cross-site scripting vulnerability exists in SAP R/3 Enterprise Application. The vulnerability stems from the lack of proper validation of client-side data in the web application. An...

Schneider Electric 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera Cross-Site Request Forgery Vulnerability

Schneider Electric 1st Gen Pelco Sarix Enhanced Camera and Schneider Electric Spectra Enhanced PTZ Camera are products of Schneider Electric, France. The Schneider Electric 1st Gen Pelco Sarix Enhanced Camera is a series of fixed IP cameras and the Schneider Electric Spectra Enhanced PTZ Camera i...

CVE-2019-1854

A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attack against an affected device. The vulnerability is due to insufficient input validation on the web interface. An attacker could exploit th...

The vulnerability of Shell Integration in the Google Chrome browser, related to insufficient validation of input data, allows attackers to execute external programs.

The vulnerability of Shell Integration in the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute external programs using a specially created HTML page...

HYBBS Cross-Site Request Forgery Vulnerability

HYBBS is a lightweight community forum program. A cross-site request forgery vulnerability exists in the /?admin/user.html page in HYBBS version 2.2, which originates from a WEB application that does not adequately validate whether a request is from a trusted user. An attacker could exploit this...

The vulnerability of the coff_pointerize_aux function in the GNU Binutils development environment allows a hacker to trigger a service failure.

The vulnerability of the coffpointerizeaux function in the GNU Binutils development environment is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

CVE-2017-1200

IBM BigFix Compliance 1.7 through 1.9.91 TEMA SUAv1 SCA SCM does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. The software might connect to a malicious host while believing it is a...

The vulnerability of the MailConnect function in the software controller allows for an SSRF attack by the intruder, enabling them to carry out a malicious action. This vulnerability is present in the D-Link Central WiFi Manager, a device used for centralized control of wireless networks.

The vulnerability of the MailConnect function in the D-Link Central WiFi Manager software control panel exists due to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

VMware Workstation SVGA Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the guest system in order to exploit this vulnerability. The specific flaw exists within the handling ...

The vulnerability of the quickTemplateSelect.xhtml component of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the quickTemplateSelect.xhtml component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the beanName parameter...