Buffer overflow in sponge queue functions

Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. Patches Yes, see commit fdc6fef0...

NETGEAR R6900 and NETGEAR R6700v3 have security vulnerabilities

NETGEAR R6900 and NETGEAR R6700v3 are both products of NETGEAR, Inc.NETGEAR R6900 is a wireless router.NETGEAR R6700v3 is a router. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in the NETGEAR R6900 and NETGEAR R6700v3...

SSTP DoS

The vulnerability of the Secure Socket Tunneling Protocol SSTP implementation in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Secure Channel Windows DoS

The vulnerability of the Secure Channel component in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Microsoft Visual Studio Code Execution

The vulnerability of the Microsoft Visual Studio software development tool is related to insufficient testing of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Network Address Translation DoS

The vulnerability of the Network Address Translation NAT technology implementation in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using specially created data...

Linux kernel Bluetooth Arbitrary Command Execution

The vulnerability of the Linux operating system’s Bluetooth permission checking subsystem is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted requests remotely...

PT-2023-2535

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11 Description The issue is related to errors in processing input data in the Libraries component of Oracle Solaris. It can be exploited by a remote attacker to launch a denial-of-service DoS attack, potentially causing...

Microsoft Office Code Execution

The vulnerability of the Microsoft Office package is related to insufficient testing of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Microsoft Visual Studio Code Execution

The vulnerability of the Microsoft Visual Studio software development tool is related to insufficient testing of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Cisco IOS XE DoS

The vulnerability of the HTTP-based client profiling function in Cisco IOS XE exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Pentaho Business Analytics Server Code Execution

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in errors in the processing of input data during syntax analysis of code. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Pentaho Business Analytics Server Code Execution

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in errors in the processing of input data during syntax analysis of code. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Redis Database Management System DoS

The vulnerability of the Redis database management system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows an attacker to send a specially crafted MSETNX command, causing a service failure and terminating the Redis server process...

IBM DB2 DoS

The vulnerability of the IBM DB2 database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure by executing the Load command...

Nomad Application Orchestrator DoS

The vulnerability of Nomad application orchestrators is related to the improper processing of highly compressed input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Adobe Dimension Code Execution

The software for 3D design by Adobe Dimension is vulnerable due to insufficient testing of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

Tenda AC1206 Router Arbitrary Command Execution

The vulnerability of the formWriteFacMac function in the Tenda AC1206 router microprogramming system is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow an attacker operating remotely to execute arbitrary commands...

CVE-2023-25350

Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection...

ROS-20230322-03

A vulnerability in the Git program is related to the input of processed input data - a path outside the working tree can be overwritten by a user running "git apply". Exploiting the vulnerability could allow an attacker acting remotely to run the affected command against a malicious or compromise...