SUNNET CTMS 路径遍历漏洞

SUNNET SUNNET CTMS is a learning platform from Taiwan-based SUNNET Technology Corporation. SUNNET CTMS suffers from a path traversal vulnerability, which originates from the presence of a path traversal vulnerability that can be exploited by an authenticated, remote attacker with general user...

CVE-2023-24836 SUNNET CTMS - Path Traversal

SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operation or disrupt service...

CVE-2023-28697

CVE-2023-28697 affects Moxa MiiNePort E1 embedded module. The issue is insufficient access control, allowing an unauthenticated remote user to perform arbitrary system operations or disrupt service. Root cause and impacted details are described across multiple sources (NVD/CNVD/CVE records, CNVD,...

CVE-2023-20852

CVE-2023-20852 affects aEnrich Technology a+HRD, where Deserialization of Untrusted Data occurs in the MSMQ interpreter. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary system commands, potentially taking arbitrary system operations or disrupting service. The CVS...

aEnrich a+HRD 代码问题漏洞

aEnrich a+HRD is a full-service human resources development solution from Acer China aEnrich. A code issue vulnerability exists in aEnrich Technology a+HRD, which stems from a deserialization vulnerability in the presence of untrusted data. An unauthenticated, remote attacker could exploit this...

CVE-2023-20853 aEnrich a+HRD - Deserialization of Untrusted Data

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

The vulnerabilities of the functions d2i_PKCS7(), d2i_PKCS7_bio(), or d2i_PKCS7_fp() implemented in the PKCS #7 standard of the OpenSSL cryptographic library allow a perpetrator to cause a service failure.

The vulnerability of the functions d2iPKCS7, d2iPKCS7bio, or d2iPKCS7fp implemented in the PKCS 7 standard of the OpenSSL cryptographic library is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ndlcremove() function in Linux operating systems allows a hacker to cause a service failure.

The vulnerability of the ndlcremove function in Linux operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2023-22915

A buffer overflow vulnerability in the “fbwififorward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.30 through 5.35, USG20W-VPN firmware versions 4.30 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could...

The vulnerability of Microsoft Defender operating systems for Windows, which allows a hacker to trigger a service failure.

The vulnerability of Microsoft Defender operating systems on Windows is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending specially crafted data...

NVIDIA DGX-1 路径遍历漏洞

NVIDIA DGX-1 is a personal computing device for deep learning applications from NVIDIA Corporation. A security vulnerability exists in NVIDIA DGX-1 Servers that originates from an attacker with appropriate privileges who can upload and download arbitrary files under certain circumstances, which...

CVE-2023-21978

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: GUI. Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object...

CVE-2023-21925

Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications component: Core. Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

The vulnerability of Siemens SCALANCE X industrial switches’ web server allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of Siemens SCALANCE X industrial switches’ web servers is related to incorrect processing of POST requests sent to the web server. Exploiting this vulnerability allows a malicious actor to trigger service failures or execute arbitrary code...

The vulnerability in the web administration interface of the Local Status Page (LSP) of Cisco Meraki software for network devices allows a hacker to trigger a service failure or gain unauthorized access to protected information.

The vulnerability of the administration web interface for Local Status Pages LSP in Cisco Meraki network devices stems from the low entropy of default account credentials. Exploiting this vulnerability could allow an attacker to cause service interruptions or gain unauthorized access to protected...

CVE-2023-20030

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery SSRF attack through an affected device, or negatively impact the responsiveness of the...

CVE-2023-0977

A heap-based overflow vulnerability in Trellix Agent Windows and Linux version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsvc process memory block resulting in the service becoming unavailable...

GNU Binutils 缓冲区错误漏洞

GNU Binutils is a set of binary tools developed by the GNU Project, mainly used to deal with target files e.g., executables, libraries, etc., covering compilation, linking, debugging, and other phases of the function. GNU Binutils suffers from a buffer overflow vulnerability that originates from ...

The vulnerability of the DHCP implementation in the software-based quadcopter DJI Spark protocol allows a perpetrator to cause service failure.

The vulnerability of the DHCP implementation in DJI Spark quadrocopters’ software lies in the exhaustion of the IP address pool due to changes in the security-critical protection mechanism. Exploiting this vulnerability allows a malicious actor to cause service failure by sending specially crafte...

PT-2023-2484 · Moxa · Miineport E1

Name of the Vulnerable Software and Affected Versions: Moxa MiiNePort E1 affected versions not specified Description: The issue is related to insufficient access control, allowing an unauthenticated remote user to exploit the vulnerability and perform arbitrary system operations or disrupt servic...