22554 matches found
CVE-2025-26354
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...
CVE-2023-31345
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...
Q-Free MAXTIME Suite security vulnerabilities
Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions. An attacker could exploit the vulnerability to overwrite sensitive files via a specially crafted HTTP request...
Q-Free MAXTIME Suite security vulnerabilities
Q-Free MAXTIME Suite is a software suite for local traffic signal management from Q-Free. A security vulnerability exists in Q-Free MAXTIME Suite version 2.11.0 and prior versions. An attacker could exploit the vulnerability to overwrite sensitive files via a specially crafted HTTP request...
PT-2025-7057 · Nitrokey · Nitrokey 3 Firmware
Name of the Vulnerable Software and Affected Versions: Nitrokey 3 Firmware versions 1.8.0 and prior test releases with PIV enabled Description: The PIV application in the Nitrokey 3 Firmware could accept invalid keys for authentication of the admin key, potentially compromising the integrity of t...
CVE-2025-26354: Path Traversal: '.../...//'
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua copy endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...
CVE-2025-26356: Path Traversal: '.../...//'
A CWE-35 "Path Traversal" in maxtime/api/database/database.lua setActive endpoint in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests...
CVE-2025-26349: Relative Path Traversal
A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests...
CVE-2023-31345: Improper Access Control for Volatile Memory Containing Boot Code
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...
CVE-2025-25201: Improper Authentication
Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the...
CVE-2023-31345
CVE-2023-31345 is an AMD SMM-handling vulnerability in AMD Secure Processor firmware. The issue stems from improper input validation in the SMM handler, which could allow a privileged attacker to overwrite SMRAM and potentially achieve arbitrary code execution. Affected context is AMD client/serv...
CVE-2023-31343
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...
CVE-2023-31343
Summary: CVE-2023-31343 is an AMD processor firmware vulnerability in the System Management Mode (SMM) handler. Connected sources describe improper input validation in the SMM handler that could let a privileged attacker overwrite SMRAM, potentially enabling arbitrary code execution on affected s...
CVE-2023-31342
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...
CVE-2023-31342
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution...
CVE-2023-31342
CVE-2023-31342 corresponds to an AMD SMM handler weakness where improper input validation can enable a privileged attacker to overwrite SMRAM, potentially enabling arbitrary code execution. The vulnerability is associated with AMD Secure Processor and related platform firmware. Affected detail fr...
CVE-2024-0179
SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution...
CVE-2024-0179
CVE-2024-0179 is an SMM Callout vulnerability in the AmdCpmDisplayFeatureSMM UEFI module that could allow locally authenticated attackers to overwrite SMRAM and execute arbitrary code. Root cause: insufficient input/data validation in the SMM callout mechanism. Impact: potential kernel- or ring-0...