17063 matches found
Design/Logic Flaw
The camgetdevicepriv function does not check the type of handle being returned device/session/link. This would lead to invalid type usage if a wrong handle is passed to it...
Design/Logic Flaw
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system...
Design/Logic Flaw
SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application...
Design/Logic Flaw
Under certain conditions SAP Commerce OCC API - versions HYCOM 2105, HYCOM 2205, COMCLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiality with no impact on integrity and...
PT-2023-4232 · Siemens · Solid Edge
Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 7 Description: A vulnerability has been identified that involves an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an...
PT-2023-4231 · Siemens · Solid Edge
Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 7 Description: A vulnerability has been identified that involves an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an...
Design/Logic Flaw
lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because xdrkadm5principalentrec does not validate the relationship between nkeydata and the keydata array...
Adopting guidance from the US National Cybersecurity Strategy to secure the Internet of Things
The recently published United States National Cybersecurity Strategy warns that many popular Internet of Things IoT devices are not sufficiently secure to protect against many of today’s common cybersecurity threats.1 The strategy also cautions that many of these IoT devices are difficult—or, in...
Design/Logic Flaw
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubelysendformdata AJAX action...
Design/Logic Flaw
Rejected reason: This was deemed as a false positive both by the reporter and upstream kernel...
Design/Logic Flaw
In Gitea through 1.17.1, repo cloning can occur in the migration function...
North Korean Hackers Targets Russian Missile Engineering Firm
Two different North Korean nation-state actors have been linked to a cyber intrusion against NPO Mashinostroyeniya, a major Russian missile engineering company. Cybersecurity firm SentinelOne said it identified "two instances of North Korea related compromise of sensitive internal IT...
Cross-Site Scripting (XSS)
gitlab is vulnerable to Cross-Site Scripting XSS attacks. This vulnerability occurs due to a flaw in the way that GitLab handles design images. An attacker can exploit this vulnerability to inject and execute malicious javascript on victim's browser...
Design/Logic Flaw
A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifi...
Design/Logic Flaw
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...
Design/Logic Flaw
An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...
Huawei HarmonyOS Security Vulnerability
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS has a security vulnerability that stems from the presence of a flawed vulnerability introduced during the design process. An attacker...
Design/Logic Flaw
Rejected reason: This CVE has been rejected because it is unclear whether the issue rests in the original repository microsoft/ContosoAir, the forked repository Apetree100122/ContosoAir, or both. If the Microsoft repository is vulnerable, Microsoft is the appropriate CVE Numbering Authority...
Design/Logic Flaw
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....