CVE-2023-49254

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

Design/Logic Flaw

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, howeve...

Microsoft Message Queuing Information Disclosure Vulnerability (CNVD-2024-04951)

Microsoft Message Queuing is the solution for implementing asynchronous and synchronous scenarios that require high performance. An information disclosure vulnerability exists in Microsoft Message Queuing, which can be exploited by an attacker to obtain sensitive information from heap memory...

Microsoft Message Queuing Denial of Service Vulnerability (CNVD-2024-04948)

Microsoft Message Queuing is the solution for implementing asynchronous and synchronous scenarios that require high performance. A denial of service vulnerability exists in Microsoft Message Queuing, which can be exploited by an attacker to cause a denial of service on a system...

Tenda AX1803 Buffer Overflow Vulnerability (CNVD-2024-02210)

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX1803 v1.0.0.1, which originates from the iptv.city.vlan parameter of the formGetIptv method failing to correctly validate the length and size of the input data, and can be exploite...

Tenda AX1803 Buffer Overflow Vulnerability (CNVD-2024-02213)

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX1803 v1.0.0.1, which originates from the adv.iptv.stballvlans parameter of the formSetIptv method failing to correctly validate the length of the input data, and can be exploited b...

Microsoft Visual Studio Elevation of Privilege Vulnerability (CNVD-2024-11163)

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. An elevation of privilege vulnerability exists in Microsoft Visual Studio, which can be exploited by...

Tenda AX1803 Buffer Overflow Vulnerability (CNVD-2024-02214)

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX1803 v1.0.0.1, which originates from the adv.iptv.stbpvid parameter of the formSetIptv method failing to correctly validate the length of the input data, and can be exploited by an...

Adobe Substance 3D Stager Out-of-Bounds Read Vulnerability (CNVD-2024-02725)

Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. An out-of-bounds read vulnerability exists in Adobe Substance 3D Stager 2.1.3 and earlier versions, which can be exploited by attackers to obtain sensitive information...

Tenda AX1803 Buffer Overflow Vulnerability (CNVD-2024-02212)

Tenda AX1803 is a dual-band Gigabit WIFI6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX1803 v1.0.0.1, which originates from the iptv.stb.port parameter of the formGetIptv method failing to correctly validate the length and size of the input data, and can be exploited...

IBM CICS Transaction Gateway Access Control Error Vulnerability

IBM CICS Transaction Gateway is a connector for modernizing enterprise CICS assets from International Business Machines IBM. An access control error vulnerability exists in IBM CICS Transaction Gateway version 9.3, which can be exploited by an attacker to transfer or view files...

CVE-2024-21893

creationtimestamp| type| source ---|---|--- 2024-01-10 20:21:17+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus2/2024 2024-01-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1197 2024-01-11 11:25:20+00:00| seen|...

CVE-2023-46805

creationtimestamp| type| source ---|---|--- 2024-01-10 20:21:17+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus2/2024 2024-01-10 23:16:36+00:00| seen| https://t.me/ctinow/166193 2024-01-11 00:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-01-11...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-29357 Microsoft SharePoint Server Privilege Escalation Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and po...

Microsoft's January 2024 Windows Update Patches 48 New Vulnerabilities

Microsoft has addressed a total of 48 security flaws spanning its software as part of its Patch Tuesday updates for January 2024. Of the 48 bugs, two are rated Critical and 46 are rated Important in severity. There is no evidence that any of the issues are publicly known or under active attack at...

CISA Flags 6 Vulnerabilities - Apple, Apache, Adobe, D-Link, Joomla Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added six security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. This includes CVE-2023-27524 CVSS score: 8.9, a high-severity vulnerability impacting the Apache Superset...

CVE-2024-0352

creationtimestamp| type| source ---|---|--- 2024-01-10 00:26:49+00:00| seen| https://t.me/ctinow/165471 2024-01-13 16:56:20+00:00| published-proof-of-concept| https://t.me/codeb0ss/1353 2024-01-26 11:11:49+00:00| seen| https://t.me/ctinow/174138 2024-02-25 16:59:19+00:00|...

Siemens JT2Go and Teamcenter Visualization Buffer Overflow Vulnerability (CNVD-2024-01390)

JT2Go is a JT file viewer.Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios. A buffer overflow vulnerability exists in Siemens JT2Go and Teamcenter Visualization, which can be exploited by an attacker to execute code in the context of the...

Siemens SIMATIC CN 4100 Using Default Credentials Vulnerability

The SIMATIC CN 4100 is a communication node that can be connected to third-party systems. A Use Default Credentials vulnerability exists in the Siemens SIMATIC CN 4100, which can be exploited by an attacker to gain full control of an affected device using credentials...

CVE-2022-48618

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been...