NICM.SYS driver 3.0.0.4 as used in Novell NetWare Client 4.91 SP4 allows local users to execute arbitrary code by opening the \\\\.\\nicm device and providing crafted kernel addresses via IOCTLs with the METHOD_NEITHER buffering mode.


WebKit before r53525 as used in Google Chrome before 4.0.249.89 allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element as demonstrated by a <ruby>><table><rt> sequence.


The affected product is vulnerable to an out-of-bounds write while processing project files which allows an attacker to craft a project file that would allow arbitrary code execution.


Iris 3.8 before build 1548 as used in Xpient point of sale (POS) systems allows remote attackers to execute arbitrary commands via a crafted request to TCP port 7510 as demonstrated by opening the cash drawer.


An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 12.3. A sandboxed process may be able to circumvent sandbox restrictions.


An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.5 Security Update 2021-004 Catalina Security Update 2021-005 Mojave. A sandboxed process may be able to circumvent sandbox restrictions.


The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network which can be easily spoofed and used to log in to make operational changes to the system.


A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.


SAP Information Steward version 4.2 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.


A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.


Google V8 before 3.17.13 as used in Google Chrome before 27.0.1444.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code as demonstrated by the Bejeweled game.


LibTIFF prior to 4.0.4 as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.


XMLTooling-C before 1.5.5 as used in OpenSAML-C and Shibboleth Service Provider (SP) does not properly handle integer conversion exceptions which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.


Google V8 before 3.13.7.5 as used in Google Chrome before 23.0.1271.64 does not properly perform write operations which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


Google V8 before 3.14.5.3 as used in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds access to stack memory.


libvterm through 0+bzr726 as used in Vim and other products mishandles certain out-of-memory conditions leading to a denial of service (application crash) related to screen.c state.c and vterm.c.


fasttrack p2p as used in (1) KaZaA before 1.5 (2) grokster and (3) morpheus allows remote attackers to cause a denial of service (memory exhaustion) via a series of client-to-client messages which pops up new windows per message.


A vulnerability in Locally Significant Certificate (LSC) management for the Cisco Wireless LAN Controller (WLC) could allow an authenticated remote attacker to cause the device to unexpectedly restart which causes a denial of service (DoS) condition. The attacker would need to have valid administrator credentials. The vulnerability is due to incorrect input validation of the HTTP URL used to establish a connection to the LSC Certificate Authority (CA). An attacker could exploit this vulnerability by authenticating to the targeted device and configuring a LSC certificate. An exploit could allow the attacker to cause a DoS condition due to an unexpected restart of the device.


A vulnerability in the remote access VPN session manager of Cisco Adaptive Security Appliance (ASA) Software could allow a unauthenticated remote attacker to cause a denial of service (DoS) condition on the remote access VPN services. The vulnerability is due to an issue with the remote access VPN session manager. An attacker could exploit this vulnerability by requesting an excessive number of remote access VPN sessions. An exploit could allow the attacker to cause a DoS condition.


Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.


In a Dynamic Host Configuration Protocol version 6 (DHCPv6) environment the jdhcpd daemon may crash and restart upon receipt of certain DHCPv6 solicit messages received from a DHCPv6 client. By continuously sending the same crafted packet an attacker can repeatedly crash the jdhcpd process causing a sustained Denial of Service (DoS) to both IPv4 and IPv6 clients. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D171 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D236 15.1X53-D496; 16.1 versions prior to 16.1R3-S10 16.1R7-S4; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10 17.1R3; 17.2 versions prior to 17.2R1-S8 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6 17.4R2-S3; 18.1 versions prior to 18.1R2-S4 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.


Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access.


A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS). This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D25 prior to 12.1X46-D71 12.1X46-D73 on SRX Series; 12.3X48 versions prior to 12.3X48-D50 on SRX Series; 15.1X49 versions prior to 15.1X49-D75 on SRX Series.


On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled a certain sequence of BGP session restart on a remote peer that has the graceful restart mechanism enabled may cause the local routing protocol daemon (RPD) process to crash and restart. Repeated crashes of the RPD process can cause prolonged Denial of Service (DoS). Graceful restart helper mode for BGP is enabled by default. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S3; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.2X75 versions prior to 17.2X75-D105; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R1-S7 17.4R2-S2 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D12 18.2X75-D30; 18.3 versions prior to 18.3R1-S4 18.3R2. Junos OS releases prior to 16.1R1 are not affected.


The flowd process responsible for forwarding traffic in SRX Series services gateways may crash and restart when processing specific transit IP packets through an IPSec tunnel. Continued processing of these packets may result in an extended Denial of Service (DoS) condition. This issue only occurs when IPSec tunnels are configured. Systems without IPSec tunnel configurations are not vulnerable to this issue. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D171 15.1X49-D180 on SRX Series; 18.2 versions 18.2R2-S1 and later prior to 18.2R3 on SRX Series; 18.4 versions prior to 18.4R2 on SRX Series.


Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series Intel(R) Pentium(R) Processor N Series Intel(R) Celeron(R) J Series Intel(R) Celeron(R) N Series Intel(R) Atom(R) Processor A Series Intel(R) Atom(R) Processor E3900 Series Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access.


Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart (vmcore). By continuously sending a specially crafted packet to the fxp0 interface an attacker can repetitively crash the rpd process causing prolonged Denial of Service (DoS). Affected releases are Juniper Networks SRX5000 Series: 12.1X46 versions prior to 12.1X46-D82; 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160.


A vulnerability in the srxpfe process on Protocol Independent Multicast (PIM) enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing (PIM) messages. Sustained receipt of these packets may lead to an extended denial of service condition. Affected releases are Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D80; 15.1X49 versions prior to 15.1X49-D160; 17.3 versions prior to 17.3R3-S7 17.4 versions prior to 17.4R2-S8 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2; 18.3 versions prior to 18.3R2.


Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.


On Junos OS rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets destined to port 111 should be dropped. Due to an information leak vulnerability responses were being generated from the source address of the management interface (e.g. fxp0) thus disclosing internal addressing and existence of the management interface itself. A high rate of crafted packets destined to port 111 may also lead to a partial Denial of Service (DoS). Note: Systems with fxp0 disabled or unconfigured are not vulnerable to this issue. This issue only affects Junos OS releases based on FreeBSD 10 or higher (typically Junos OS 15.1+). Administrators can confirm whether systems are running a version of Junos OS based on FreeBSD 10 or higher by typing: user@junos> show version | match kernel JUNOS OS Kernel 64-bit 20181214.223829_fbsd-builder_stable_10 Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12 15.1R7-S4; 15.1X53 versions prior to 15.1X53-D236; 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8; 17.3 versions prior to 17.3R2; 17.4 versions prior to 17.4R1-S1 17.4R1-S7 17.4R2. This issue does not affect Junos OS releases prior to 15.1.


Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.


Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45 13.0.10 and 14.0.10 may allow a privileged user to potentially enable denial of service via local access.


When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S4 16.1R7-S5; 16.2 versions prior to 16.2R2-S9 16.2R3; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S1; 17.3 versions prior to 17.3R3-S3 17.3R3-S4 17.3R4; 17.4 versions prior to 17.4R1-S7 17.4R2-S3 17.4R2-S4 17.4R3; 18.1 versions prior to 18.1R2-S4 18.1R3-S4 18.1R4; 18.2 versions prior to 18.2R2-S2 18.2R2-S3 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3 18.3R2; 18.4 versions prior to 18.4R1-S2 18.4R2. This issue does not affect Junos releases prior to 16.1R1.


The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a regular TCP packet which causes the processor to crash. This issue affects all SRX Series platforms that support URL-Filtering and have web-filtering enabled. Affected releases are Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 15.1X49 versions prior to 15.1X49-D181 15.1X49-D190 on SRX Series; 17.3 versions on SRX Series; 17.4 versions prior to 17.4R1-S8 17.4R2-S5 17.4R3 on SRX Series; 18.1 versions prior to 18.1R3-S6 on SRX Series; 18.2 versions prior to 18.2R2-S1 18.2R3 on SRX Series; 18.3 versions prior to 18.3R1-S2 18.3R2 on SRX Series; 18.4 versions prior to 18.4R1-S1 18.4R2 on SRX Series.


Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.


Unhandled exception in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an authenticated user to potentially enable a denial of service via local access.


A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory aka '.NET Framework Denial of Service Vulnerability'.


Improper flow control in crypto routines for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable a denial of service via local access.


In MPLS environments receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and restart. By continuously sending a specially crafted SNMP packet an attacker can repetitively crash the RPD process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS : 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D48 on EX/QFX series; 15.1 versions prior to 15.1R4-S9 15.1R7-S2; 15.1F6 versions prior to 15.1F6-S11; 15.1X49 versions prior to 15.1X49-D141 15.1X49-D144 15.1X49-D150 on SRX Series; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D68 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX Series; 15.1X53 versions prior to 15.1X53-D590 on EX2300/EX3400 Series; 15.1X54 on ACX Series; 16.1 versions prior to 16.1R3-S10 16.1R4-S11 16.1R6-S5 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S8 17.1R3; 17.2 versions prior to 17.2R1-S7 17.2R3; 17.2X75 versions prior to 17.2X75-D92 17.2X75-D102 17.2X75-D110; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R1-S4 17.4R2; 18.1 versions prior to 18.1R1-S1 18.1R2-S1 18.1R3; 18.2X75 versions prior to 18.2X75-D10.


Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00


A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause the device to reboot unexpectedly. The vulnerability is due to incomplete input validation of a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) ingress packet header. An attacker could exploit this vulnerability by sending a crafted TLS/SSL packet to an interface on the targeted device. An exploit could allow the attacker to cause the device to reload which will result in a denial of service (DoS) condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. A valid SSL or TLS session is required to exploit this vulnerability.

denial of service
weak authentication management


The Quake 3 engine as used in multiple game packages allows remote attackers to cause a denial of service (shutdown game server) and possibly crash the server via a long infostring possibly triggering a buffer overflow.


In ImageMagick 7.0.8-35 Q16 there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c which allows an attacker to cause a denial of service or code execution via a crafted image file.


In Artifex MuPDF 1.12.0 there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file.


Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

denial of service
buffer overflow
arbitrary code execution


OpenJPEG before r2944 as used in PDFium in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document related to j2k.c jp2.c pi.c t1.c t2.c and tcd.c.


OpenJPEG before r2908 as used in PDFium in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document related to j2k.c jp2.c and t2.c.


In IXP EasyInstall 6.2.13723 there is Directory Traversal on TCP port 8000 via the Engine Service by an unauthenticated attacker who can access the server's filesystem with the access rights of NT AUTHORITY\\SYSTEM.


In

LibSass

there

is

an

illegal

address

access

at

Sass::Parser::parse_css_variable_value_token

that

will

lead

to

a

DoS

attack.


In LibSass 3.5-stable there is an illegal address access at Sass::Eval::operator that will lead to a DoS attack.


In libwebm through 2018-10-03 there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack.


In Bro through 2.5.5 there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.


In Bro through 2.5.5 there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser.


Insufficient memory protection in System Management Mode (SMM) and Intel(R) TXT for certain Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.


SAP

Treasury

and

Risk

Management

(EA-FINSERV

and

and

does

not

perform

necessary

authorization

checks

for

authorization

objects

and

resulting

in

escalation

of

privileges.


Insufficient path checking in Intel(R) System Support Utility for Windows before 2.5.0.15 may allow an authenticated user to potentially enable an escalation of privilege via local access.


Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially enable escalation of privilege via local access.


Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.


Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access.


Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater supporting TXT may allow a privileged user to potentially enable escalation of privilege via local access.


Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65 11.11.65 11.22.65 12.0.35 may allow an authenticated user to potentially enable escalation of privilege via adjacent network access.


Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.


Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access.


Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65 11.11.65 11.22.65 12.0.35 and Intel(R) TXE 3.1.65 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.


Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may allow an authenticated user to potentially enable escalation of privilege via local access.


Read of RFC destination does not always perform necessary authorization checks resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI before versions 2008_1_700 2008_1_710 and 740).


Insufficient memory protection in Intel(R) TXT for certain Intel(R) Core Processors and Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.


Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL version 1) performs an inadequate authorization check for an authenticated user potentially resulting in escalation of privileges.


Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalation of privilege via local access.


Under some circumstances masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user resulting in escalation of privileges.


Out

of

bound

read

would

occur

while

trying

to

read

action

category

and

action

ID

without

validating

the

action

length

of

the

Rx

Frame

body

in

Snapdragon

Auto

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in


In WelcomeActivity.java and related files there is a possible permissions bypass due to a partially provisioned Device Policy Client. This could lead to local escalation of privilege leaving an Admin app installed with no indication to the user with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-132261064


In

GetPermittedAccessibilityServicesForUser

of

DevicePolicyManagerService.java

there

is

a

possible

permissions

bypass

due

to

a

missing

permission

check.

This

could

lead

to

local

escalation

of

privilege

with

no

additional

permissions

required.

User

interaction

is

not

needed

for

exploitation.

Product:

Android.

Versions:

Android

ID:


In rw_t3t_act_handle_fmt_rsp of rw_t3t.cc there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-120497437


In isPackageDeviceAdminOnAnyUser of PackageManagerService.java there is a possible permissions bypass due to a missing permissions check. This could lead to local escalation of privilege with no additional permissions required. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-128599183


An ActiveX control in IcoLaunch.dll in Mitsubishi Electric Automation MC-WorX Suite 8.02 allows user-assisted remote attackers to execute arbitrary programs via a crafted HTML document in conjunction with a Login Client button click.


An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0 8.02 8.04 and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.


A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying OS.


A vulnerability in the Cisco SD-WAN Solution could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation of the save command in the CLI of the affected software. An attacker could exploit this vulnerability by modifying the save command in the CLI of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying operating system of an affected device and escalate their privileges to the root user.


A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions aka 'Microsoft Browsers Tampering Vulnerability'.


An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0803 CVE-2019-0859.


A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.


A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0979.


A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0742.


HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may under certain circumstances have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.


In all Qualcomm products with Android releases from CAF using the Linux kernel disabling asserts causes an instruction inside of an assert to not be executed resulting in incorrect control flow.


A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account.


Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.


Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosure via local access.


Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.


Under

certain

conditions

the

PI

Integration

Builder

Web

UI

of

SAP

NetWeaver

Process

Integration

(versions:

to

to

and

to

allows

an

attacker

to

access

passwords

used

in

FTP

channels

leading

to

information

disclosure.


Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.


Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.


Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local access.


Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via local access.


Adobe Acrobat and Reader versions 2018.011.20063 and earlier 2017.011.30102 and earlier and 2015.006.30452 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

information disclosure
out of bound read


In ImageMagick 7.0.8-36 Q16 there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c which allows an attacker to cause a denial of service or information disclosure via a crafted image file.

information disclosure
denial of service
buffer overread


In ImageMagick 7.0.8-43 Q16 there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.


In Plib through 1.85 there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.


In sam2p 0.49.4 there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the function ReadImage because \width * height\ multiplications occur unsafely.


In MP4v2 2.0.0 there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.


The SSL protocol 3.0 as used in OpenSSL through 1.0.1i and other products uses nondeterministic CBC padding which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack aka the \POODLE\ issue.


During process shutdown a document could have caused a use-after-free of a languages service object leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93 Thunderbird < 91.2 and Firefox ESR < 91.2.


In iOS before 11.4 a memory corruption issue exists and was addressed with improved memory handling.


In iOS before 9.3.3 a memory corruption issue existed in the kernel. This issue was addressed through improved memory handling.


In MP4v2 2.0.0 there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.


In FreeRDP before 2.1.0 there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0.


The PlRPC module possibly 0.2020 and earlier for Perl uses the Storable module which allows remote attackers to execute arbitrary code via a crafted request which is not properly handled when it is deserialized.


The Nokia Browser possibly Nokia Symbian 60 Browser 3rd edition allows remote attackers to cause a denial of service (crash) via JavaScript that constructs a large Unicode string.


In sample6 of SkSwizzler.cpp there is a possible out of bounds write due to improper input validation. This could lead to remote code execution in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-118372692.


A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs aka \Visual Studio Remote Code Execution Vulnerability.\ This affects Microsoft Visual Studio.


In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5 the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.


An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 watchOS 5.2. A local user may be able to view sensitive user information.


A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause an affected device to reload. This vulnerability is due to a parsing issue on DNS packets. An attacker could exploit these vulnerabilities by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected device to reload resulting in a denial of service (DoS) condition.


A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to an incorrect processing of FCoE packets when the fcoe-npv feature is uninstalled. An attacker could exploit this vulnerability by sending a stream of FCoE frames from an adjacent host to an affected device. An exploit could allow the attacker to cause packet amplification to occur resulting in the saturation of interfaces and a DoS condition. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5) and 9.2(2).


A vulnerability in the Cisco Discovery Protocol or Link Layer Discovery Protocol (LLDP) implementation for the Cisco IP Phone 7800 and 8800 Series could allow an unauthenticated adjacent attacker to cause an affected phone to reload unexpectedly resulting in a temporary denial of service (DoS) condition. The vulnerability is due to missing length validation of certain Cisco Discovery Protocol or LLDP packet header fields. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol or LLDP packet to the targeted phone. A successful exploit could allow the attacker to cause the affected phone to reload unexpectedly resulting in a temporary DoS condition. Versions prior to 12.6(1)MN80 are affected.


A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website.


A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system.


A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer (SSL) certificate. The vulnerability is due to insufficient SSL certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted SSL certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.


A vulnerability in the Deterministic Random Bit Generator (DRBG) also known as Pseudorandom Number Generator (PRNG) used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause a cryptographic collision enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.


A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to hijack a valid user session on an affected system. An attacker could use this impersonated session to create a new user account or otherwise control the device with the privileges of the hijacked session. The vulnerability is due to a lack of proper session management controls. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted device. A successful exploit could allow the attacker to take control of an existing user session on the device. Exploitation of the vulnerability requires that an authorized user session is active and that the attacker can craft an HTTP request to impersonate that session.


A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated local attacker with physical access to obtain sensitive information from an affected device. The vulnerability is due to insecure removal of cleartext encryption keys stored on local partitions in the hard drive of an affected device. An attacker could exploit this vulnerability by retrieving data from the physical disk on the affected partition(s). A successful exploit could allow the attacker to retrieve encryption keys possibly allowing the attacker to further decrypt other data and sensitive information on the device which could lead to the disclosure of confidential information.


A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.


Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated remote attacker to overflow a buffer which then allows the execution of arbitrary code with root privileges on the underlying operating system. The vulnerabilities are due to insufficient validation of user-supplied input and improper boundary checks when reading data into an internal buffer. An attacker could exploit these vulnerabilities by sending malicious requests to the web management interface of an affected device. Depending on the configuration of the affected switch the malicious requests must be sent via HTTP or HTTPS.


A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software Cisco FirePOWER Services Software for ASA and Cisco Firepower Management Center Software could allow an unauthenticated remote attacker to bypass filtering protections. The vulnerability is due to improper detection of the initial use of a protocol on a nonstandard port. An attacker could exploit this vulnerability by sending traffic on a nonstandard port for the protocol in use through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems that would otherwise be blocked. Once the initial protocol flow on the nonstandard port is detected future flows on the nonstandard port will be successfully detected and handled as configured by the applied policy.


Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.


A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests aka 'Remote Desktop Services Remote Code Execution Vulnerability'.


The labels gadget in Jira before version 7.13.2 and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.


In Materialize through 1.0.0 XSS is possible via the Autocomplete feature.


In Materialize through 1.0.0 XSS is possible via the Tooltip feature.


In Materialize through 1.0.0 XSS is possible via the Toast feature.


In Blog_mini 1.0 XSS exists via the author name of a comment reply in the app/main/views.py articleDetails() function related to app/templates/_article_comments.html.


In MediaWiki through 1.37 XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker and the javascript: URL scheme (among others) can be used.


In Bootstrap before 3.4.0 XSS is possible in the affix configuration target property.


In Bootstrap before 3.4.0 XSS is possible in the tooltip data-viewport attribute.


In Bootstrap before 4.1.2 XSS is possible in the data-container property of tooltip.


In Graylog before 2.4.6 XSS was possible in typeahead components related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.


In Bootstrap before 4.1.2 XSS is possible in the collapse data-parent attribute.


In Bootstrap before 4.1.2 XSS is possible in the data-target property of scrollspy.


In all Qualcomm products with Android releases from CAF using the Linux kernel in the function wma_roam_synch_event_handler vdev_id is received from firmware and used to access an array without validation.


In all Android releases from CAF using the Linux kernel a vulnerability exists in the access control settings of modem memory.


An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.


An Access Control vulnerability exists in D-Link DIR-823G REVA1 1.02B05 (Lastest) via any parameter in the HNAP1 function


An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g id h form_password_hidden and form_change HTTP POST parameters are set.


An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver which could let a malicious user upload PHP Trojan files.


An Access Control vulnerability exists in CLARO KAON CG3000 1.00.67 in the router configuration which could allow a malicious user to read or update the configuraiton without authentication.


An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service.


An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privileges which allows a malicious attacker bypass the lock screen function.


Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles as demonstrated by an action=createVoucher request to agents.php.


Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.


Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction and obtain full access to any folder within the NAS


An Access Control vulnerability exists in the Facebook Twitter and Embedded plugins in Vanilla Forums before 2.0.17.9.


An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getList($decompath. '/ Upload/Plugins / which could let a remote malicious user execute arbitrary code.

access control vulnerability
arbitrary code execution


Incorrect Access Control vulnerability in Online Book Store v1.0 via admin_verify.php which could let a remote mailicious user bypass authentication and obtain sensitive information.

access control vulnerability
bypass authentication


An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 in the forgot-password function becuase the application allows email addresses as usernames which can cause a Denial of Service.

access control vulnerability
denial of service


Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Cabinet via unspecified vectors.

access control vulnerability
improper access control


Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and/or server's internal information via unspecified vectors.


Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier and for iOS ver.4.111.0 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.


Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and alter the data of Workflow via unspecified vectors.


Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Bulletin Board via unspecified vectors.


Improper access control vulnerability in WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allows an attacker to obtain configuration information via unspecified vectors.


Improper access control vulnerability in goo blog App for Android ver.1.2.25 and earlier and for iOS ver.1.3.3 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.


Improper access control vulnerability in DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to bypass access restriction and to start a telnet service via unspecified vectors.


Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Scheduler via unspecified vectors.


Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the data of Phone Messages via unspecified vectors.


Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to bypass access restriction and obtain the date of Custom App via unspecified vectors.


Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.


Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain and/or alter the setting information without the access privilege via unspecified vectors.


Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.


Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected device by processing a specially crafted request.


Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Bulletin Board via unspecified vectors.


Improper access control vulnerability in FirmwareUpgrade in QSAN Storage Manager allows remote attackers to reboot and discontinue the device. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.


Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code execution by replacing FOTA update file.


Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated privilege.


Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.


Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause local file inclusion in webview.


Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview.


Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth information in Bluetooth application.


Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview.


Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x 3.3.1040 in 3.3.x and 3.4.4210 in 3.4.x allows untrusted applications to access some functions of Cameralyzer.


Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below and 3.9.10.11 in Android P(9.0) and above allows untrusted applications to cause arbitrary webpage loading in webview.


Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview.


Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary settings during Initialization State.


Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Setup wizard. The patch blocks entry point of the vulnerability.


Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.


Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications from Galaxy Store without user interactions.


Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set the arbitrary folder as Secret Folder without Samsung Security Supporter permission


Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that set in Weather without permission. The patch adds proper protection to prevent access to location information.


Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file without Samsung Flow permission.


Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.


Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary activity without a proper permission


Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.


Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certain conditions.


Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in.


Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with system privilege.


Improper access control vulnerability in SamsungRecovery prior to version 8.1.43.0 allows local attckers to delete arbitrary files as SamsungRecovery permission.


Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key of hardware keyboard.


Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact information without permission.


Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.


Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12) 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(10) allows attackers to register reminders or execute exporeted activities remotely.


Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11) 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows untrusted applications to take a picture in screenlock status.


Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors.


Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecified vectors.


Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.


Improper Access Control vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to bypass security mechanisms and deny access to the SYSTEM folder via incorrectly applied permissions.


Improper access control vulnerability in masvc.exe in McAfee Agent (MA) prior to 5.6.4 allows local users with administrator privileges to disable self-protection via a McAfee supplied command-line utility.


Improper Access Control vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.10.0 allows local users to view sensitive files via a carefully crafted HTTP request parameter.


Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.

access control vulnerability
improper access control
arbitrary command execution


In all Qualcomm products with Android releases from CAF using the Linux kernel the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer.


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Error in kernel observed while accessing freed mask pointers after reallocating memory for mask table.


IBM QRadar SIEM 7.3 7.4 and 7.5 allows for users to access information across tenant and domain boundaries in some situations. IBM X-Force ID: 208397.


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel when requesting rssi timeout access invalid memory may occur since local variable 'context' stack data of wlan function is free.


An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.1. A device may be passively tracked via BSSIDs.


An access issue was addressed with additional sandbox restrictions. This issue affected versions prior to iOS 12 macOS Mojave 10.14.


An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.0 tvOS 14.0 iOS 14.0 and iPadOS 14.0. A local user may be able to view senstive user information.


An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 watchOS 8.5. A malicious application may be able to identify what other applications a user has installed.


In all Qualcomm products with Android releases from CAF using the Linux kernel an output buffer is accessed in one thread and can be potentially freed in another.


An access issue was addressed with improved access restrictions. This issue is fixed in Security Update 2021-005 Catalina macOS Big Sur 11.6 tvOS 15. A user may gain access to protected parts of the file system.


An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to access restricted files.


An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files.


Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420 430 allows an authenticated attacker to access information which would otherwise be restricted.


A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated local attacker to access sensitive system information on an affected device. The vulnerability is due to improper memory operations performed at encryption time when affected software handles configuration updates. An attacker could exploit this vulnerability by retrieving the contents of specific memory locations of an affected device. A successful exploit could result in the disclosure of keying materials that are part of the device configuration which can be used to recover critical system information.


An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.4 Security Update 2021-003 Catalina. A malicious application may be able to access a user's call history.


An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 iOS 15.2 and iPadOS 15.2 watchOS 8.3. An application may be able to access a user's files.


IrfanView version 4.44 (32bit) with FPX Plugin before 4.45 has an Access Violation and crash in processing a FlashPix (.FPX) file.


In SWFTools an address access exception was found in pdf2swf. FoFiTrueType::writeTTF()


In SWFTools an address access exception was found in swfdump swf_GetBits().


When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0 the application crashes and becomes temporarily unavailable to the user until restart of the application


When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0 the application crashes and becomes temporarily unavailable to the user until restart of the application


When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated PhotoShop Document (.PSD) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated HPGL format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Viewer the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated Universal 3D (.U3D) files received from untrusted sources in SAP 3D Visual Enterprise Viewer the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual Enterprise Viewer the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens manipulated Jupiter Tessellation (.JT) format files received from untrusted sources in SAP 3D Visual Enterprise Viewer version 9 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens a manipulated Photoshop Document (.psd 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens a manipulated Universal 3D (.u3d 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0 the application crashes and becomes temporarily unavailable to the user until restart of the application.


When a user opens a manipulated Picture Exchange (.pcx 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0 the application crashes and becomes temporarily unavailable to the user until restart of the application.


In OpenEXR 2.2.0 an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.


In OpenEXR 2.2.0 an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.


In OpenEXR 2.2.0 an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.


In OpenEXR 2.2.0 an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.


When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visual Enterprise Viewer the application crashes and becomes temporarily unavailable to the user until restart of the application.


Microsoft Excel 97 2000 and 2002 allows remote attackers to execute arbitrary code via a spreadsheet with a malicious XLM (Excel 4) macro that bypasses the macro security model.


In Magentoprior to 1.9.4.3 and Magento prior to 1.14.4.3 an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.


HP Operations Agent 8.51 8.52 8.53 and 8.60 on Solaris 10 uses a blank password for the opc_op account which allows remote attackers to execute arbitrary code via unspecified vectors.


Vignette StoryServer 4 and 5 and Vignette V/5 and V/6 with the SSI EXEC feature enabled allows remote attackers to execute arbitrary code via a text variable to a Vignette Application that is later displayed.


Microsoft Internet Explorer 5.01 6 and 7 uses certain COM objects from Imjpcksid.dll as ActiveX controls which allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this issue might be related to CVE-2006-4193.


RealNetworks RealPlayer before 15.0.4.53 and RealPlayer SP 1.0 through 1.1.5 does not properly parse ASMRuleBook data in RealMedia files which allows remote attackers to execute arbitrary code via a crafted file.


tinyproxy HTTP proxy 1.5.0 1.4.3 and earlier allows remote attackers to execute arbitrary code via memory that is freed twice (double-free).


SquirrelMail 1.4.11 and 1.4.12 as distributed on sourceforge.net before 20071213 has been externally modified to create a Trojan Horse that introduces a PHP remote file inclusion vulnerability which allows remote attackers to execute arbitrary code.


Mozilla Firefox before 31.0 Firefox ESR 24.x before 24.7 and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.


In PyYAML before 5.1 the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.


In Fazecast jSerialComm Version 2.2.2 and prior an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code.


APT before 1.0.9 when the Acquire::GzipIndexes option is enabled does not validate checksums which allows remote attackers to execute arbitrary code via a crafted package.


feh before 1.8 when the --wget-timestamp option is enabled might allow remote attackers to execute arbitrary commands via shell metacharacters in a URL.


Apache Shiro before 1.2.5 when a cipher key has not been configured for the \remember me\ feature allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.


Drupal 6.x before 6.38 when used with PHP before 5.4.45 5.5.x before 5.5.29 or 5.6.x before 5.6.13 might allow remote attackers to execute arbitrary code via vectors related to session data truncation.


Opening a maliciously crafted project file may cause an out-of-bounds write which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior).


Adobe Acrobat and Reader versions 2019.010.20069 and earlier 2019.010.20069 and earlier 2017.011.30113 and earlier version and 2015.006.30464 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe s 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable heap overflow vulnerability when processing TIFF image data. Successful exploitation could lead to arbitrary code execution.


An ActiveX control in lookout650.ocx lookout660.ocx and lookout670.ocx in National Instruments Lookout 6.5 through 6.7 allows remote attackers to execute arbitrary code by triggering the download of and calls to an arbitrary DLL file.


This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.


This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners (advertisers) can remotely execute arbitrary code on a user device.


UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.


gitnote

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

Markdown

file

as

demonstrated

by

a

javascript:window.parent.top.require('child_process').execFile

substring

in

the

onerror

attribute

of

an

IMG

element.


Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the \Java file manager\ and \Upload and Download\ privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.


Lhaz 1.33 allows remote attackers to execute arbitrary code via unknown vectors as actively exploited in August 2007 by the Exploit-LHAZ.a gzip file a different issue than CVE-2006-4116.


Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive related to the chroot for archive extraction.


TUTOS 1.1 allows remote attackers to execute arbitrary code by uploading the code using file_new.php then directly accessing the uploaded code via a request to the repository containing the code.


mpg321 0.2.10 allows remote attackers to overwrite memory and possibly execute arbitrary code via an mp3 file that passes certain strings to the printf function possibly triggering a format string vulnerability.


osTicket allows remote attackers to view sensitive uploaded files and possibly execute arbitrary code via an HTTP request that uploads a PHP file to the ticket attachments directory.


phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.


libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file related to \free\ function calls in the \lexer's memory clean-up procedure.\


TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php.


SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.


Firefox 1.0 allows remote attackers to execute arbitrary code via plugins that load \privileged content\ into frames as demonstrated using certain XUL events when a user drags a scrollbar two times aka \Firescrolling.\


Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing \.\ (dot).


PHPNetToolpack 0.1 allows remote attackers to execute arbitrary code via shell metacharacters in the a_query variable.


PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.


Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.


Palo Alto Networks PAN-OS before 6.1.19 7.0.x before 7.0.19 7.1.x before 7.1.14 and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.


Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially-crafted LZH archive file a attacker could execute arbitrary code execution.


Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types which allows remote attackers to execute arbitrary code via a shortcut or launcher that contains an Exec entry.


MySQL 4.0.23 and earlier and 4.1.x up to 4.1.10 allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by using CREATE FUNCTION to access libc calls as demonstrated by using strcat on_exit and exit.


Netscape 6.2.3 and earlier and Mozilla 1.0.1 allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.


MediaWiki 1.3.8 and earlier when used with Apache mod_mime does not properly handle files with two file extensions such as .php.rar which allows remote attackers to upload and execute arbitrary code.


ScriptLogic 4.01 and possibly other versions before 4.14 uses insecure permissions for the LOGS$ share which allows users to modify log records and possibly execute arbitrary code.


A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system.


A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software. Successful exploitation could allow the attacker to execute arbitrary code on the affected system.


Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated local attacker with valid administrator credentials to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.


A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated remote attacker to cause a denial of service (DoS) condition and execute arbitrary code as the root user. The vulnerability is due to improper bounds checking by the vContainer. An attacker could exploit this vulnerability by sending a malicious file to an affected vContainer instance. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected vContainer which could result in a DoS condition that the attacker could use to execute arbitrary code as the root user.


In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38 with MPM event worker or prefork code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.


The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.


A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by administrator permission.


Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated remote attacker can use this vulnerability to execute arbitrary code.


In OpenEMR 5.0.1 and earlier controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.


DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a compromised folder.


A vulnerability was discovered in vdsm version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root.


In OpenEMR 5.0.1 and earlier controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.


Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote authenticated attacker to execute arbitrary code by uploading a malicious PHP file.


DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Prior to 16.0.18 allows local users to execute arbitrary code via execution from a compromised folder.


In OpenEMR 5.0.1 and earlier controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.


Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy which is exported and opened on the their machine. In our checks the user must explicitly allow the code to execute.


The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the search path of the installer prior to its execution by a local administrator. This would cause loading of the malicious DLL which would allow the attacker to execute arbitrary code in the context of an administrator.


Remote arbitrary code execution in Micro Focus Data Protector version 10.03 this vulnerability could allow remote arbitrary code execution.


Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protections.


DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker.


Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.


DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights.


An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413 and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers.


In OpenEMR 5.0.1 and earlier controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.


An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the FINGERPRINT Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14864 (August 2019).


Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30 RBS50 before 2.3.5.30 and RBK50 before 2.3.5.30.


An issue was discovered on Samsung mobile devices with N(7.1) O(8.x) P(9.0) and Q(10.0) software. Arbitrary code execution is possible on the lock screen. The Samsung ID is SVE-2019-15266 (December 2019).


uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension.


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the EXT_FR Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14847 (August 2019).


An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the MLDAP Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14867 (August 2019).


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SKPM Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14892 (August 2019).


The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not require adequate authentication which may allow an attacker to read sensitive information or execute arbitrary code. This is a different issue than CVE-2019-16879 and CVE-2019-20045.


An issue was discovered on Samsung mobile devices with P(9.0) (TEEGRIS and Qualcomm chipsets). There is arbitrary memory overwrite in the SEM Trustlet leading to arbitrary code execution. The Samsung IDs are SVE-2019-14651 SVE-2019-14666 (November 2019).


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEC_FR Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14851 (August 2019).


An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. There is type confusion in the WVDRM Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14885 (September 2019).


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the HDCP Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14850 (August 2019).


An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groovy code when generating a report resulting in arbitrary code execution on the underlying server.


An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEM Trustlet leading to arbitrary code execution. The Samsung ID is SVE-2019-14891 (August 2019).


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5 and from version 8.6.0 before 8.7.2.


Adobe Acrobat and Reader versions 2019.010.20100 and earlier 2019.010.20099 and earlier 2017.011.30140 and earlier 2017.011.30138 and earlier 2015.006.30495 and earlier and 2015.006.30493 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2019.010.20100 and earlier 2019.010.20099 and earlier 2017.011.30140 and earlier 2017.011.30138 and earlier 2015.006.30495 and earlier and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2019.010.20069 and earlier 2019.010.20069 and earlier 2017.011.30113 and earlier version and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.012.20035 and earlier 2019.012.20035 and earlier 2017.011.30142 and earlier 2017.011.30143 and earlier 2017.011.30142 and earlier 2015.006.30497 and earlier and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.010.20069 and earlier 2019.010.20069 and earlier 2017.011.30113 and earlier version and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .


A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2 and Magento Commerce prior to 1.14.4.2 Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.


Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2019.010.20100 and earlier 2019.010.20099 and earlier 2017.011.30140 and earlier 2017.011.30138 and earlier 2015.006.30495 and earlier and 2015.006.30493 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.


In NICE Engage through 6.5 the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces without restricting registration of MBeans which allows remote attackers to execute arbitrary code via the RMI protocol by using the JMX connector. The observed affected TCP port is 6338 but based on the product's configuration a different one could be vulnerable.


An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak Replicator 4.5.12.1108.


A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.


A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.


Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to execute arbitrary code.


Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.


Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.


The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0 3.4.1 3.4.2 3.4.3 3.5.0 3.5.1 (18.8) 3.5.2 (18.11) and 3.6.0 (19.6) does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data which allows attackers to execute arbitrary code inside the Centrify process via (1) a crafted application that makes a pipe connection to the process and sends malicious serialized data or (2) a crafted Microsoft Management Console snap-in control file.


Equinox Control Expert all versions is vulnerable to an SQL injection attack which may allow an attacker to remotely execute arbitrary code.


sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.


in

the

RESET.PRO

Adobe

Stock

API

Integration

for

PrestaShop

and

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

.php

file.


An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.


An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.


in

the

RESET.PRO

Adobe

Stock

API

integration

for

PrestaShop

allows

remote

attackers

to

execute

arbitrary

code

by

uploading

a

.php

file.


Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A remote unauthenticated attacker can exploit this vulnerability by sending crafted RMI requests to execute arbitrary code on the target host.


Free Photo Viewer 1.3 allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that triggers a malformed SEH as demonstrated by a 0012ECB4 FreePhot.00425642 42200008 corrupt entry.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7369.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7423.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7844.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7696.


A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code in all versions of ProClima prior to version 8.0.0.


Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client program (MR)LanScope Cat detection agent (DA) prior to Ver.9.2.1.0 LanScope Cat server monitoring agent (SA SAE) prior to Ver.9.2.2.0 LanScope An prior to Ver 2.7.7.0 (LanScope An 2 series) and LanScope An prior to Ver 3.0.8.1 (LanScope An 3 series)) allow authenticated attackers to obtain unauthorized privileges and execute arbitrary code.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WebAssembly.Instance method. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7466.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. There is an issue with the way the product handles URIs within certain schemes. The product does not warn the user that a dangerous navigation is about to take place. Because special characters in the URI are not sanitized this could lead to the execution of arbitrary commands. An attacker can leverage this vulnerability to execute code in the context of the current user at medium integrity. Was ZDI-CAN-7162.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing watermarks within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-8801.