CVE-2023-37192

Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, potentially allowing them to redirect Bitcoin transactions to wallets of their own choosing...

CVE-2022-4326 Trellix xAgent permission bypass vulnerability

Improper preservation of permissions vulnerability in Trellix Endpoint Agent xAgent prior to V35.31.22 on Windows allows a local user with administrator privileges to bypass the product protection to uninstall the agent via incorrectly applied permissions in the removal protection functionality...

ASB-A-233972091

'remappfnrange' here may map out of size kernel memory for example, may map the kernel area, and because the 'vma-vmpageprot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploited...

SSRF on /proxy

Description draw.io is vulnerable to SSRF on the /proxy endpoint. It's trivial to bypass the protections on checkUrlParameter. Proof of Concept 1. Make a request to proxy?url=http%3a//0:8080/ GET /proxy?url=http%3a//0:8080/ HTTP/1.1 Host: 127.0.0.1:8080 sec-ch-ua: "NotA:Brand";v="8",...

The vulnerability of the input protection mechanism in Cisco Firepower Management Center (FMC) software allows a hacker to disclose the protected information.

The vulnerability of the input protection mechanism in Cisco Firepower Management Center FMC software is related to errors in processing incoming data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

The vulnerability of the BitLocker data protection function of the Microsoft Windows operating system, which allows a hacker to bypass the authentication process

The vulnerability of the BitLocker data protection function in the Microsoft Windows operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker to bypass the authentication process...

The vulnerability of NETGEAR’s Wi-Fi router software models D3600, D6000, D6200, and D6220 lies in the insufficient protection of operational data, allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of Wi-Fi router microprogramming systems from NETGEAR models D3600, D6000, D6200, and D6220 lies in the insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of the protected information...

The vulnerability of Azure RTOS operating systems, related to insufficient protection of sensitive data, allows attackers to gain unauthorized access to protected information.

The vulnerability of Azure RTOS operating systems is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

SUSE: Security Advisory (SUSE-SU-2017:0899-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Johnson Controls Metasys

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Johnson Controls Equipment: Metasys Servers, Engines, and Tools Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could give an authenticated...

The vulnerability of Microsoft Teams for iOS, related to the lack of protection for sensitive data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft Teams corporate platform for iOS is related to the lack of protection for sensitive data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Global Protect Agent’s endpoint protection software lies in the lack of protection for service data, which allows attackers to read VPN cookie information.

The vulnerability of the reporting component of the Global Protect Agent for Linux software lies in the lack of protection for service data. Exploiting this vulnerability could allow attackers to read VPN cookie information...

The vulnerability of the web protection component of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, and Kaspersky Security Cloud allows a hacker to redirect users to any desired website.

The vulnerability of the web protection component of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, and Kaspersky Security Cloud lies in the use of open redirection. Exploiting this vulnerability allows a...

CVE-2018-6975

The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted...

AirWatch Agent and VMware Content Locker updates resolve data protection vulnerabilities

a. The AirWatch Agent for iOS devices contains a data protection vulnerability The AirWatch Agent for iOS devices contains a data protection vulnerability whereby the files and keychain entries in the Agent are not encrypted. VMware would like to thank Stephan Sekula of Compass Security for...

Authorization

Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password protected. This attack appear to be exploitable via The victim must visit a...

PT-2017-12429 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center affected versions not specified Description: A lack of cross-site request forgery CSRF protection in the Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to execute unwanted...

Blue Shield Web Page Tamper Protection System Has Arbitrary Source Code File Download Vulnerability

BlueShield Web Tamper Protection System is a web page tampering prevention product. Blueshield Web Tamper Protection System has an arbitrary source code file download vulnerability. As long as the php followed by %20, %2e, ::$DATA may download php files, allowing attackers to obtain the source...

Apple Mac computer firmware 0day EFI rootkit vulnerability

MAC is apple's self-developed operating system, now commonly used operating systems are windows, linux, mac. MacBook Pro Retina, MacBook Pro and MacBook Air computers may have a security vulnerability in the EFI firmware update, the attacker does not need to physically touch the target machine, c...

CVE-2011-4699

The Ubermedia Twidroyd Legacy com.twidroydlegacy application 4.3.11 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application...