Vulnerability of software for configuring, testing, and deploying Schneider Electric EcoStruxure Power Commission devices—related to the disclosure of information in error-prone areas—allows a perpetrator to disclose protected information.

The vulnerability of the software for configuring, testing, and deploying Schneider Electric EcoStruxure Power Commission involves exposing information in the error-prone data area. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information through a specially...

Design/Logic Flaw

Symantec Advanced Secure Gateway ASG and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web...

CVE-2021-46825

Symantec Advanced Secure Gateway ASG and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web...

The vulnerability of the mod_lua module in the Apache HTTP Server allows a hacker to cause a service failure.

The vulnerability of the modlua module in the Apache HTTP Server is related to the unlimited distribution of resources when processing the function with zero parameter r:parsebody0. Exploiting this vulnerability allows a malicious actor to cause service failures by sending a specially crafted HTT...

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software allows a perpetrator to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service disruption.

The vulnerability of Oracle Banking Trade Finance’s Infrastructure component is related to errors in the code. Exploiting this vulnerability allows a malicious actor to create, delete, or alter access to critical data, gain read-only access to data, or cause partial service interruptions through...

The vulnerability of the Console component of the Oracle WebLogic Server application server allows a attacker to gain read access to data or modify data.

The vulnerability of the Console component of the Oracle WebLogic Server application lies in reading data beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to gain access to read data or modify data through specially crafted HTTP requests...

CVE-2022-20828

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...

Denial Of Service (DoS)

@discordjs/opus is vulnerable to denial of service. An attacker is able cause an application crash via sending crafted requests through an encoder with zero channels, or a non-initialized buffer...

CVE-2022-32138

In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite...

A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

...

The vulnerability of the web-based service interfaces of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to induce service failures.

The vulnerability of the web-service interfaces of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger a service failure through a specially...

The vulnerability of the Grafana data processing web tool lies in its ability to bypass authentication procedures, allowing attackers to elevate their privileges by sending specially crafted HTTP requests.

The vulnerability of the Grafana data processing web tool is related to the possibility of bypassing the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending a specially crafted HTTP request...

The vulnerability of the web-service interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to enhance their privileges.

The vulnerability of the web-service interfaces of Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to the improper assignment of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially...

Vapor 安全漏洞

Vapor is a Swift web development framework. Can be used to develop high-performance Web applications , support for iOS, OS X and Ubuntu systems. A denial-of-service vulnerability exists in Vapor versions prior to 4.61.1 that stems from not properly handling incoming error messages and can be...

Cisco Adaptive Security Appliance Software Remote Access SSL VPN DoS (cisco-sa-asa-dos-tL4uA4AA)

A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper validation of errors that are logged as a...

CVE-2022-30425

Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request...

The vulnerability of the TrueConf Server software lies in the lack of authentication for a critical function, which allows a perpetrator to trigger a service failure.

The vulnerability of the TrueConf Server software is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a perpetrator to remotely cause service failures by sending specially crafted requests...

CVE-2022-26833

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

CVE-2022-26303

An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can send a sequence of requests to trigge...

CVE-2022-26043

An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attacker can send a sequence of requests t...