Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the...

[SECURITY] [DLA 3522-1] hdf5 security update

Debian LTS Advisory DLA-3522-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany August 09, 2023 https://wiki.debian.org/LTS Package : hdf5 Version : 1.10.4+repack-10+deb10u1 CVE ID : CVE-2018-11206 CVE-2018-17233 CVE-2018-17234 CVE-2018-17237 CVE-2018-17434...

Adobe Commerce Security Breach

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. A security vulnerability exists in Adobe Commerce versions 2.4.6-p1 and earlier, 2.4.5-p3 and earlier, and 2.4.4-p4 and earlier, which is rooted in vulnerability to XML injection and can be exploited...

CVE-2023-20564

Insufficient validation in the IOCTL Input Output Control input buffer in AMD RyzenTM Master may permit a privileged attacker to perform memory reads and writes, potentially leading to a loss of confidentiality or arbitrary kernel execution. Mitigation Please contact AMD support for updates...

AMD Ryzen™ Master Security Bulletin

Bulletin ID: AMD-SB-7004 Potential Impact: Varies by CVE, see descriptions below Severity: V aries by CVE, see descriptions below Summary AMD Ryzen™ Master is a software tool that provides users access to advanced settings, such as clock and voltage settings, to control system performance in...

AMD Ryzen Master Input Validation Error Vulnerability

AMD Ryzen Master is a software tool from UltraMicroelectronics AMD for managing and tuning the performance of AMD Ryzen processors. A security vulnerability exists in AMD Ryzen Master that stems from inadequate input buffer validation, which could allow a privileged attacker to perform memory rea...

UNISOC Chipsets Buffer Error Vulnerability

UNISOC Chipsets is a chipset from China's Unisplendour UNISOC. A security vulnerability exists in UNISOC Chipsets due to a lack of boundary checking in the camera driver module, which may result in out-of-bounds reads...

MediaTek Chip Buffer Error Vulnerability

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in the MediaTek chips, which arises from improper validation of inputs to the wlan service module, which may result in out-of-bounds reads...

VulnCheck KEV: CVE-2021-4332

The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 pro and 2.0.6 free. The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately,...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in the MediaTek chips, which stems from an incorrect calculation of the buffer size in the pda module, which may result in out-of-bounds reads...

MediaTek Chip Buffer Error Vulnerability

MediaTek chips are a variety of chips from MediaTek, a Chinese company called MediaTek. A security vulnerability exists in the MediaTek chips, which arises from improper validation of inputs to the wlan service module, which may result in out-of-bounds reads...

The vulnerability in the web platform used for creating ZKBio Access lVS control and access management systems stems from errors in processing the relative path to the catalog. This allows a hacker to gain access to and read arbitrary files.

The vulnerability of the web platform used for creating ZKBio Access lVS access control and management systems is related to errors in processing the relative path to the catalog. Exploiting this vulnerability could allow a malicious actor to gain read access to arbitrary files...

Denial Of Service (DoS)

firefox and thunderbird are vulnerable to Denial of Service DoS attacks. The vulnerability occurs when Firefox parses HTML with DOMParser in low memory situations which could lead to an application crash due to out-of-bounds reads...

CVE-2023-25600

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016...

CVE-2023-25600

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016...

Design/Logic Flaw

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016...

PT-2023-5006 · 3S Smart Software Solutions · Codesys

Name of the Vulnerable Software and Affected Versions: CODESYS affected versions not specified Description: The issue is related to insufficient input validation in the CmpAppForce component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition...

CVE-2023-25600

CVE-2023-25600 concerns InsydeH2O: a malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial-of-service condition. Multiple sources (NVD, Red Hat, CVE lists) confirm the issue and the fixed version. Affected component: InsydeH...

CVE-2023-25600

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016...

CVE-2023-25600

An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016...