Media Foundation Memory Corruption Vulnerability

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

Siemens Spectrum Power 5

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Spectrum Power 5 Vulnerability: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS 2. RISK EVALUATION Successful exploitation of this vulnerability could...

Microsoft Edge browser vulnerability, related to incorrect use of access policies, allows attackers to escalate their privileges.

The vulnerability of Microsoft Edge relates to the improper use of access policies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to enhance their privileges through a specially crafted web page...

CVE-2019-20489

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface setup.cgi has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FWremote.htm&todo=cfginit reque...

Stack overflow

fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup webpage parameter when fradiusip1 is malformed...

CVE-2020-9534

fmwlan.c on D-Link DIR-615Jx10 devices has a stack-based buffer overflow via the formWlanSetup webpage parameter when fradiusip1 is malformed...

UBUNTU-CVE-2020-6418

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

marketingcrossing.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1102840 Security Researcher Broly157 Helped patch 1571 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting marketingcrossing.com...

Schneider Electric Modicon Ethernet Serial RTU

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: Modicon BMXNOR0200H Vulnerabilities: Improper Check for Unusual or Exceptional Conditions, Improper Access Control 2. RISK EVALUATION Successful exploitation of these...

Media Foundation Memory Corruption Vulnerability

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

PT-2020-1724 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Internet Explorer affected versions not specified Description: The issue exists due to errors in handling objects in memory by the scripting engine. Exploitation of this issue could allow a remote attacker to execute arbitrary code using a...

IRS Launches “Identity Theft Central” Webpage

The Internal Revenue Service IRS has launched its “Identity Theft Central” webpage to provide 24/7 access to online information regarding tax-related identity theft and data security protection. Tax-related identity theft occurs when someone steals personal information to commit tax fraud. The...

vibescaster.com Cross Site Scripting vulnerability

Security Researcher kun-fly Helped patch 590 vulnerabilities Received 7 Coordinated Disclosure badges Received 40 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting vibescaster.com website and its users. Following coordinate...

CVE-2019-17573

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

chromium-browser: Use after free in audio

Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

The vulnerability of the processor for spectrum analyzers in microprogrammed software routers from Netgear, such as CG3700EMR, COMPAL 7486E, COMPAL 7284E, Sagemcom F@st 3686, Sagemcom F@st 3890, Netgear C6250EMR, Technicolor TC7230, Cisco EPC3928AD, Humax HGB10R-02, and Arris Surfboard SB8200, allows a hacker to gain full control over the device.

The vulnerability of the processor for spectrum analysis in microprogrammed software routers from Netgear, such as CG3700EMR, COMPAL 7486E, COMPAL 7284E, Sagemcom F@st 3686, Sagemcom F@st 3890, Netgear C6250EMR, Technicolor TC7230, Cisco EPC3928AD, Humax HGB10R-02, and Arris Surfboard SB8200,...

CVE-2019-17022

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

CVE-2019-17022

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

CVE-2019-17022

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

CVE-2019-6204

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting...