CVE-2023-52112

Unauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to perform abnormally...

PT-2024-13268 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns inaccurate trust relationships in distributed scenarios, which could impact service confidentiality upon successful exploitation. Recommendations: At the moment,...

CVE-2024-20712 Adobe Substance 3D Stager v2.1.1 Vulnerability III

Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in tha...

CVE-2023-23439

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak...

CVE-2023-23434

Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak...

Adobe InDesign Code Issues Vulnerabilities

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign has a security vulnerability that can be exploited by attackers to cause a denial of service...

MindsDB Information Disclosure Vulnerability

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. An information disclosure vulnerability exists in MindsDB versions prior to 23.11.4.1, which stems from insufficient protection of sensitive information in file.py and can be exploited by an attacker to cause information...

Schweitzer Engineering Laboratories SEL-411L

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Schweitzer Engineering Laboratories Equipment : SEL-411L Vulnerability : Improper Restriction of Rendered UI Layers or Frames 2. RISK EVALUATION Successful exploitation of this vulnerability...

CVE-2023-40076

In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

DEBIAN-CVE-2023-42916

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versio...

Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5

The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...

GeoServer server-side request forgery vulnerability (CNVD-2024-14588)

GeoServer is an open source software server written in Java. Allows users to share and edit geospatial data. GeoServer suffers from a server-side request forgery vulnerability that stems from the fact that the OGC Web Processing Service WPS specification is designed to process information from an...

PT-2023-18083 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue allows determining whether an app is installed without query permissions, due to side channel information disclosure. This could lead to local information disclosure with ...

PT-2023-26341 · Ibm · Ibm Cognos Dashboards On Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Cognos Dashboards on Cloud Pak for Data version 4.7.0 Description: The issue exposes sensitive information in environment variables, which could aid in further attacks against the system. Recommendations: For IBM Cognos Dashboards on Clou...

The vulnerability of D-Link DIR-820L router’s microprogramming software, due to lack of access control mechanisms, allows a hacker to execute arbitrary code.

The vulnerability of D-Link DIR-820L router microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the Packet Forwarding Engine (PFE) module of Juniper Networks’ Junos OS allows a hacker to trigger a service failure.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS is related to insufficient checking of exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

PT-2023-32186 · Vrite · Vrite

Name of the Vulnerable Software and Affected Versions: vrite versions prior to 0.3.0 Description: The issue is related to the allocation of resources without limits or throttling in the GitHub repository vriteio/vrite. This could potentially lead to exploitation. Recommendations: For versions pri...

Siemens SICAM A8000 Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Delta Electronics DVP32ES2 PLC Security Vulnerability

The Delta Electronics DVP32ES2 PLC is a programmable logic controller PLC from Delta Electronics of Taiwan, China. A security vulnerability exists in Delta Electronics DVP32ES2 PLC version 1.48. An attacker could exploit the vulnerability to cause a denial of service on the system...

Mozilla: Use-after-free in Ion Compiler

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NULL bytes and cause a potentially exploitable crash...