The vulnerability of the CreateAttachmentFromUri method in the Microsoft Exchange Server mail server allows a hacker to disclose protected information.

The vulnerability of the CreateAttachmentFromUri method in Microsoft Exchange Server’s mail server is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the DownloadDataFromOfficeMarketPlace method in the Microsoft Exchange Server mail server allows a hacker to disclose protected information.

The vulnerability of the DownloadDataFromOfficeMarketPlace method in the Microsoft Exchange Server mail server is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

The vulnerability of the Drawing SDK, a software development tool for engineering applications, relates to writing beyond the buffer boundaries in memory. This allows an attacker to execute arbitrary code.

The vulnerability of the Drawing SDK, a software development tool for engineering applications, is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using specially crafted DXF files...

NewStart CGSL MAIN 6.06 : neod Multiple Vulnerabilities (NS-SA-2023-0142)

The remote NewStart CGSL host, running version MAIN 6.06, has neod packages installed that are affected by multiple vulnerabilities: - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfslinux.go incorrectl...

PT-2023-31790 · Topografix · Topografix Dataplugin For Gpx

Name of the Vulnerable Software and Affected Versions: TopoGrafix DataPlugin for GPX affected versions not specified Description: An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this issue by getting a user ...

libreswan: Invalid IKEv1 Quick Mode ID causes restart

A NULL pointer dereference flaw was found in Libreswan when processing IKEv1 Quick Mode requests. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, it triggers a NULL pointer dereference error. This flaw allows a malicious client or...

The vulnerability of the ChainedSerializationBinder class in the Microsoft Exchange Server mail server allows a hacker to execute arbitrary code.

The vulnerability of the ChainedSerializationBinder class in the Microsoft Exchange Server mail server relates to the deserialization of unreliable data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with SYSTEM privileges remotely...

CVE-2023-5964

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This...

CVE-2023-45161

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

CVE-2023-45161

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

CVE-2023-45163

The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

Design/Logic Flaw

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

Design/Logic Flaw

The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

CVE-2023-5964 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This...

CVE-2023-5964

The CVE-2023-5964 issue affects the 1E Exchange End-User Interaction product pack, specifically the 1E-Exchange-DisplayMessage instruction. The vulnerability arises from improper validation of Caption and Message parameters, enabling arbitrary code execution with SYSTEM privileges on Windows clie...

CVE-2023-5964 1E-Exchange-DisplayMessage instruction allows for arbitrary code execution

The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This...

CVE-2023-45163 1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution

The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

CVE-2023-45163

CVE-2023-45163 concerns the 1E-Exchange-CommandLinePing instruction in the 1E Exchange Network product pack. Versions prior to v18.1 fail input validation, enabling specially crafted input to perform arbitrary code execution with SYSTEM privileges on Windows clients. Mitigation: update the instru...

CVE-2023-45161 1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...

CVE-2023-45161 1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution

The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. This instruction only runs on...