239 matches found
AZL-6344 CVE-2021-42376 affecting package busybox for versions less than 1.35.0-1
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input...
CVE-2020-12488
The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission...
vivo Jovi Smart Scene 安全漏洞
Vivo Jovi Smart Scene is used by China's Vivo to provide users with efficient, interactive and decision-making personalized services. The vivo Jovi Smart Scene suffers from a security vulnerability that allows an attacker to access sensitive information stored in the jovi Smart Scene module by...
redis: Integer overflow bug in the ziplist data structure
An integer overflow issue was found in the redis ziplist data structure. The vulnerability involves modifying the default ziplist configuration parameters hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value to a very large value, and then...
redis: Integer overflow issue with intsets
An integer overflow issue was found in redis. The vulnerability involves changing the default "set-max-intset-entries" configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. This flaw allows a remote attacker to leak arbitrary contents of the...
redis: Integer overflow issue with intsets
An integer overflow issue was found in redis. The vulnerability involves changing the default "set-max-intset-entries" configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. This flaw allows a remote attacker to leak arbitrary contents of the...
DEBIAN-CVE-2021-3746
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerabili...
The vulnerability of the syntax analyzer in the Cisco IOS XE and Cisco IOS operating systems’ command-line TrustSec CLI allows a attacker to trigger a service failure.
The vulnerability of the syntax analyzer in the Cisco IOS XE and Cisco IOS operating systems’ command-line interface is related to improper interaction between the user web interface and the command-line interface. Exploiting this vulnerability allows a malicious actor to trigger a service failur...
PT-2023-12250 · Opensc +1 · Opensc +1
Name of the Vulnerable Software and Affected Versions: OpenSC smart card middleware versions prior to 0.23 Description: A stack overflow issue exists in the OpenSC smart card middleware due to crafted responses to APDUs, which can lead to a stack overflow. Recommendations: For versions prior to...
Remote Code Execution
redis is vulnerable to remote code execution. An out-of-bounds read and integer overflow to buffer overflow exists and allows an attacker to execute arbitrary code on the host OS by changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially...
CVE-2021-20333
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.1...
CVE-2021-20333
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.1...
CVE-2021-20333
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21 and MongoDB Server v4.2 versions prior to 4.2.1...
CVE-2021-20333
Removed by vendor...
Cisco Integrated Management Controller Command Injection (cisco-sa-CIMC-CIV-pKDBe9x5)
According to its self-reported version, Cisco Integrated Management Controller IMC is affected by a vulnerability in the web UI that allows an authenticated, remote attacker to inject arbitrary code and execute arbitrary commands at the underlying operating system level. The vulnerability is due ...
PT-2021-3477 · Libtpms +1 · Libtpms +1
Name of the Vulnerable Software and Affected Versions: libtpms affected versions not specified Description: The issue is caused by an out-of-bounds access in memory due to a flaw in the libtpms library. This can be triggered by specially-crafted TPM 2 command packets containing illegal values. Th...
The vulnerability of the IBM DB2 database management system lies in the insufficient cleaning of special elements in the output data used by the incoming component, which allows a hacker to trigger a service failure.
The vulnerability of the IBM DB2 database management system is related to insufficient cleaning of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using specially created commands...
CVE-2020-18102
Cross Site Scripting XSS in HotelsServer v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php"...
Cross site scripting
Cross Site Scripting XSS in HotelsServer v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php"...
