404 matches found
CVE-2023-29155 INEA ME RTU Missing Authentication for Critical Function
Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an attacker to obtain admin-level access to the host system...
CrushFTP Security Vulnerability
CrushFTP is a file transfer server. A security vulnerability exists in CrushFTP versions prior to 10.5.1 that stems from improper control of object properties, which can be exploited by an attacker to gain partial control over Java properties and allow arbitrary file reads and deletion of...
CVE-2023-47130
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29...
CVE-2023-47130 Unsafe deserialization of user data in yiisoft/yii
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29...
CVE-2023-47130 Unsafe deserialization of user data in yiisoft/yii
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29...
CVE-2023-47130 Unsafe deserialization of user data in yiisoft/yii
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29...
CVE-2023-47130: Deserialization of Untrusted Data
Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29...
Command injection
Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. Note: An attacker must have access to the system...
CVE-2023-26156
Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. Note: An attacker must have access to the system...
Buffer Overflows
qemu is vulnerable to Buffer Overflows. A guest I/O address overflow vulnerability allows an attacker to overwrite arbitrary memory on the host system by exploiting a flaw in the way that QEMU handles guest I/O operations...
PT-2023-6767
Name of the Vulnerable Software and Affected Versions INEA ME RTU firmware versions 3.36b and prior Description The issue is related to inadequate authentication procedures in the INEA ME RTU firmware, which could allow an attacker to gain unauthorized access to the device. Specifically, versions...
Improper Access Control
virtualbox is vulnerable to Improper Access Control. This vulnerability allows an attacker with local access to a vulnerable VirtualBox installation to execute arbitrary code on the host system...
Improper Access Control
virtualbox is vulnerable to Improper Access Control. This vulnerability allows an attacker with local access to a vulnerable VirtualBox installation to execute arbitrary code on the host system...
Improper Access Control
virtualbox is vulnerable to Improper Access Control. This vulnerability allows an attacker with local access to a vulnerable VirtualBox installation to execute arbitrary code on the host system...
Command injection
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...
CVE-2023-26153
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...
CVE-2023-26153
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...
geokit-rails Command Injection vulnerability
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geolocation' cookie. This issue can be exploited remotely via a malicious cookie value. Note: An attacker can use this vulnerability to execute commands on the...
Heap overflow
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system...