CVE Vulnerability Catalog

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in FreeType in Google Chrome prior to 86.0.4240.111. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Vulnerability in the Oracle WebLogic Server Console (Oracle Fusion Middleware) affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it and take over the server.

A cross-site scripting (XSS) vulnerability in QNAP QTS systems could allow remote attackers to inject malicious code. Fixed in specific QTS versions.

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

A cross-site scripting (XSS) vulnerability in QNAP QTS systems could allow remote attackers to inject malicious code. Fixed in specific QTS versions.

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.

Multiple vulnerabilities in the web services interface of Cisco ASA and FTD Software allow an unauthenticated, remote attacker to conduct XSS attacks against users of the interface. The issues are due to insufficient validation of user-supplied input. A successful exploit could allow arbitrary script execution in the interface context or access to sensitive browser-based information.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server.

Vulnerability in the Oracle WebLogic Server Console (Oracle Fusion Middleware) affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it and take over the server.

Vulnerability in the Pluggable authentication module of Oracle Solaris affecting versions 10 and 11. An unauthenticated attacker with network access via multiple protocols can easily exploit it and take over the system; it is not exploitable on Solaris 11.1 and later or ZFSSA 8.7 and later.

Vulnerability in Oracle Business Intelligence Enterprise Edition (component: Installation) affecting versions 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0. An unauthenticated attacker with network access via HTTP can compromise the product, leading to unauthorized access to critical data or complete access to all accessible data.

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6, iPadOS 13.6, and tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.

NETGEAR JGS516PE devices before 2.6.0.43 are affected by a lack of access control at the function level. This allows functions to be invoked that a user should not be authorized to use.

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload a custom template to perform arbitrary code execution.

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11. An attacker can exploit this vulnerability over the network.

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to immediately crash the IGMP process or cause memory exhaustion and eventual crash. This is due to incorrect handling of IGMP packets.