Design/Logic Flaw

AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability...

Design/Logic Flaw

A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the product's processes, potentially leading to remote control and unauthorized access to sensitive user data...

CVE-2023-38544

CVE-2023-38544 affects Ivanti (Secure Access Client) on Linux. A logged-in user can modify specific files, potentially enabling unauthorized changes to system-wide configuration settings, compromising integrity. Root cause: exploitation locally by a user with low privileges; impact listed as part...

HPESBNW04565 rev.2 - HPE Aruba Access Points, Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity; Remote: Arbitrary Code Execution, Arbitrary Command Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba 100 Series Access Points - See vulnerability summary for affected versions...

CVE-2023-38544: Undefined Security Weakness

A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited to compromise the integrity and security of the network on the affected system...

The vulnerability of the coffgen.c component in the GNU Binutils development environment allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the coffgen.c component in the GNU Binutils development environment is related to integer overflow. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures using a specially created PE file...

The vulnerabilities of the input/output modules in the Rsyslog software utility for logging processing allow a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the input/output modules of the Rsyslog log processing software is related to insufficient handling of the format string. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the elf32-i386.c and elf64-x86-64.c components of the GNU Binutils development environment allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the elf32-i386.c and elf64-x86-64.c components of the GNU Binutils development environment is related to integer overflow. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a...

The vulnerability of the pe_bfd_read_buildid function in the peicode.h component of the GNU Binutils development environment allows a attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the pebfdreadbuildid function in the peicode.h component of the GNU Binutils development environment is related to integer overflow. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures usin...

The vulnerability of the GNU Binutils development tool lies in the fact that operations beyond the buffer boundaries in memory can be performed. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the GNU Binutils development tooling relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2023-20566: Undefined Security Weakness

Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity...

The vulnerability of the automation tool for deploying and managing applications in Docker-enabled environments, related to improper permission storage, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the automation tool for deploying and managing applications in Docker-enabled environments is related to improper storage of permissions. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the OpenImageIO image processing library, related to the occurrence of operations outside the buffer in memory, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the OpenImageIO image processing library lies in the escape of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service failures through the use...

CVE-2023-46998

A flaw was discovered in bootbox.js. This issue may allow a remote attacker to execute arbitrary code using a specially crafted payload, compromising the confidentiality and integrity of sensitive data. Mitigation Sanitize input before adding it to a DOM element using jquery...

AsyncSSH Rogue Session Attack

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation. Details The rogue session attack targets any SSH client connecting to an AsyncSSH server, on which the attacker must have a shell...

ROS-20231031-01

A vulnerability in the Runc isolated container launch tool is related to improper saving of permissions. Exploitation of the vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial of service. Vulnerability in the Runc isolated container too...

Lack of access control on overrideSanction(), any user can override sanctioned address

Lines of code Vulnerability details Impact Without proper access control, any address can call the overrideSanction function and override the sanction status of an account. This can potentially be exploited by malicious actors to bypass sanctions and carry out unauthorized actions, putting the...

CVE-2023-43654

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

The onlySeaport is a single point of failure and a centralization risk

Lines of code Vulnerability details Impact The onlySeaport holds a lot of power within the system, which can compromise the system integrity and it's permission-less nature. Having a single EOA as onlySeaport is a large centralization risk and a single point of failure. A single private key may b...

Race Condition

tmate-ssh-server is vulnerable to Race Condition. This vulnerability exists due to the insecure creation of temporary directories, allowing a malicious attacker to compromise the integrity of session handling locally...