Memory Corruption Vulnerability in Kovac HMIStudio hs Project File

Huangshi Kewei Automatic Control Co., Ltd. is a company mainly engaged in microelectronic products, automation instrumentation development and application and related engineering supporting services and other projects. A memory corruption vulnerability exists in the Kewe HMIStudio hs project file...

Memory Corruption Vulnerability in dp2 Project File of Xinjie OP20 Screen Setting Tool

Wuxi Xinjie Electric Co., Ltd. is a well-known domestic enterprise focusing on the research, development and application of industrial automation products. A memory corruption vulnerability exists in the dp2 project file of the Xinjie OP20 screen setup tool, which can be exploited by attackers to...

dll hijacking vulnerability exists in state god dwmapi

Nanjing New Dixon Software Technology Co., Ltd. is a company mainly engaged in computer software and hardware technology development, sales, installation, technical consulting, technical services; computer system integration; network engineering and other projects. There is a dll hijacking...

CVE-2019-1002101

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could r...

Node.js third-party modules: [fileview] Inadequate Output Encoding and Escaping

I would like to report stored xss in fileview module It allows an attacker to embed malicious js code in filename there was no sanitization performed. Module module name:fileview version: 0.1.6 npm page: https://www.npmjs.com/package/fileview Module Description File browsers on web. It's easy to...

Critical WinRAR Flaw Found Actively Being Exploited

A critical 19-year-old WinRAR vulnerability disclosed last week has now been spotted actively being exploited in a spam campaign spreading malware. The campaign, discovered by researchers with 360 Threat Intelligence Center, takes advantage of a path-traversal WinRAR vulnerability, which could...

Cross site scripting

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16887

A cross-site scripting XSS flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to...

CVE-2018-16861

A cross-site scripting XSS flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and...

razorCMS HTML Injection Vulnerability

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. An HTML injection vulnerability exists in razorCMS version 3.4.7, which can be exploited by attackers to execute malicious code...

DLL Hijacking Vulnerability in GE iFix scu.exe Component

GE Intelligent Platforms' GE-IP iFIX is the world's leading industrial automation software solution that provides process visualization, data acquisition and data monitoring of manufacturing operations. A DLL hijacking vulnerability exists in the GE iFix scu.exe component, which can be exploited ...

CVE-2018-10604

SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution...

CVE-2018-10604

CVE-2018-10604 affects SEL Compass 3.0.5.1 and earlier, where incorrect default permissions grant all users full access to the Compass directory, enabling modification or overwriting of files and potential privilege escalation or code execution. The issue is documented across multiple sources (NV...

Multiple Echelon Products Information Disclosure Vulnerability (CNVD-2018-18306)

Echelon SmartServer 1 and others are products of Echelon Corporation of the United States. echelon SmartServer 1 is a multifunctional controller, which supports building automation control and enterprise energy management, etc. i.LON 100 is a network server, which is mainly used to configure and...

CVE-2018-12333

CVE-2018-12333 affects ECOS Secure Boot Stick (SBS) version 5.6.5 and is caused by insufficient verification of data authenticity. The vulnerability could allow an attacker to manipulate security-related configurations and execute malicious code on the device. Publicly documented details identify...

CVE-2017-17320

Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install ...

Double free

Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install ...

CVE-2017-17320

Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install ...

CVE-2017-17324

Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229 have an integer overflow vulnerability. The camera driver does not validate the external input parameters and causes an integer overflow, which in the after processing results in a buffer overflow. An attacker tricks...