Design/Logic Flaw

An issue has been found in function DCTStream::readHuffSym in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid read of size 2...

Design/Logic Flaw

The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attacker to elevate privileges by changing the flow of program execution within the vHub driver...

Adobe After Effects memory out-of-bounds access vulnerability

Adobe After Effects "AE" is a graphics video processing software from Adobe for organizations involved in design and video special effects, including television stations, animation production companies, personal post-production studios, and multimedia studios. Effects 18.2.1 and earlier versions...

Adobe After Effects out-of-bounds write vulnerability (CNVD-2021-54342)

Adobe After Effects "AE" is a graphics and video processing software from Adobe for organizations involved in design and video special effects, including television stations, animation production companies, personal post-production studios, and multimedia studios. Effects 18.2.1 and earlier...

Design/Logic Flaw

Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow...

MELSEC-F FX3U-ENET code issue and vulnerabilities

MELSEC-F FX3U-ENET is an Ethernet interface block from mitsubishielectric. A code issue vulnerability exists in the MELSEC-F FX3U-ENET. The vulnerability arises from an improper design or implementation during code development for a network system or product...

Design/Logic Flaw

An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock...

Design/Logic Flaw

An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator...

Autodesk Design Review Type Obfuscation Vulnerability

Autodesk Design Review ADR is a suite of AutoCAD drafting software support software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.Autodesk Design Review is vulnerable to a type obfuscation vulnerability that could b...

in cortezaproject/corteza-server

Passwords shorter than 8 characters are considered to be weak NIST SP800-63B. Maximum password length should not be set too low, as it will prevent users from creating passphrases. ... It is important to set a maximum password length to prevent long password Denial of Service attacks. STEPS FOR...

Design/Logic Flaw

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

Design/Logic Flaw

URI.js is vulnerable to URL Redirection to Untrusted Site...

Autodesk Design Review Buffer Overflow Vulnerability (CNVD-2021-53944)

Autodesk Design Review ADR is a suite of AutoCAD drawing software assist software from Autodesk, Inc. The software supports viewing, marking, measuring, printing, and tracking changes to 2D and 3D design files.A buffer overflow vulnerability exists in Autodesk Design Review, which stems from a...

Design/Logic Flaw

DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful device owner, because there is no way to reset to Factory Default settings...

Design/Logic Flaw

The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read by other applications...

Design/Logic Flaw

Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert all versions prior to V15.0 SP1, including all versions of Unity Pro, EcoStruxure Process Expert all versions, including all versions of EcoStruxure Hybrid DCS, and SCADAPack RemoteConnect for x70, all version...

Design/Logic Flaw

In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product:...

Siemens Jt2go and Siemens Teamcenter Visualization Buffer Over Read Vulnerability (CNVD-2021-53357)

Siemens Jt2go and Siemens Teamcenter Visualization are both products of Siemens AG, Germany. Siemens Jt2go is a JT file viewer. Siemens Teamcenter Visualization is a software that provides team collaboration capabilities for designing 2D and 3D scenes. A buffer over-read vulnerability exists in...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-13110 Reason: This candidate is a duplicate of CVE-2019-13110. Notes: All CVE users should reference CVE-2019-13110 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2021-34552 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...