17082 matches found
Design/Logic Flaw
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Design/Logic Flaw
The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site...
Design/Logic Flaw
Firmware in the Intel Puma 5, 6, and 7 Series might experience resource depletion or timeout, which allows a network attacker to create a denial of service via crafted network traffic...
hw: cpu: speculative store bypass
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the...
Design/Logic Flaw
Redgate .NET Reflector before 10.0.7.774 and SmartAssembly before 6.12.5 allow attackers to execute code by decompiling a compiled .NET object such as a DLL or EXE file with a specific embedded resource file...
Design/Logic Flaw
readtmp and writetmp in Inteno IOPSYS allow attackers to gain privileges after writing to /tmp/etc/smb.conf because /var is a symlink to /tmp...
CloudGoat: The ‘Vulnerable-by-Design’ AWS Environment
The post CloudGoat: The ‘Vulnerable-by-Design’ AWS Environment appeared first on Rhino Security Labs...
Synology DiskStation Manager (DSM) Multiple Vulnerabilities (Synology-SA-17:29) - Active Check
Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Design/Logic Flaw
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system...
Design/Logic Flaw
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbcrmessagemessage in rmessage.c...
Design/Logic Flaw
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in pbcpatternpack in pattern.c...
Design/Logic Flaw
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in setfieldone in bootstrap.c during a memcpy...
SQL Injection Vulnerability in Creativity Interactive Media Web Design Company's Website Building System
Creativity Interactive Media Web Design is a creative company specializing in web design planning as a base media. There is a SQL injection vulnerability in Creativity Interactive Media's web design system, which can be exploited by attackers to obtain database information...
Design/Logic Flaw
The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...
SQL Injection Vulnerability in the Website Building System of Beijing Maya Network Culture Communication Co.
Beijing Maya Network Culture Communication Co., Ltd. is a company that provides customers with a professional one-stop website construction service platform. Maya Web Design and Construction System has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive...
Design/Logic Flaw
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating t...
Logical Design Vulnerabilities in Jiangsu Jinzhi Education Unified Identity Authentication System
Jiangsu Jinzhi Education Information Co., Ltd. is a well-known provider of informatization services for colleges and universities in China. There is a logical design vulnerability in the Jiangsu Jinzhi Education Unified Identity Authentication System, which can be exploited by an attacker to rese...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none...