The vulnerability of the access control and working time recording system within SIPORT is related to the improper assignment of permissions for critical resources, allowing intruders to increase their privileges.

The vulnerability of the access control and working time recording system within SIPORT is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

mySCADA myPRO Manager Operating System Command Injection Vulnerability

mySCADA myPRO is a professional HMI/SCADA system designed primarily for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO Manager, which can be exploited by an attacker to inject arbitrary operating system commands...

CVE-2024-50054

The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system...

CVE-2024-50396 QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QT...

QNAP Systems QTS和QNAP Systems QuTS hero 格式化字符串错误漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are both products of China Weilian Technology QNAP Systems.QNAP Systems QTS is an entry operating system.QNAP Systems QuTS hero is an operating system. A format string error vulnerability exists in QNAP Systems QTS prior to version 5.2.1.2930 build...

USN-7123-1 linux-azure vulnerabilities

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service system crash or possibly expose sensitive information...

The vulnerability of Palo Alto Networks’ operating system PAN-OS, related to pointer arithmetic errors, allows a hacker to trigger a service failure.

The vulnerability of Palo Alto Networks’ operating system PAN-OS relates to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Dell SmartFabric OS10 Unauthorized Access Vulnerability

Dell SmartFabric OS10 is a Linux-based network switch operating system from Dell Dell. An unauthorized access vulnerability exists in Dell SmartFabric OS10, which arises from a file or directory issue that contains a file or directory that is accessible to an outside party. A low-privileged...

The vulnerability of the Linux operating system’s kernel component, which allows a hacker to increase their privileges within the system

The vulnerability of the Linux operating system’s kernel component is related to memory management errors after deallocation. Exploiting this vulnerability can allow an attacker to gain elevated privileges within the system...

The vulnerability of the ext4_ext_insert_extent() function in the ext4 file system of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ext4extinsertextent function in the fs/ext4/extents.c file of the Linux kernel’s file system ext4 is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

NUS-M9 安全漏洞

NUS-M9 is an ERP system from China Zhelin NUS Company. A security vulnerability exists in NUS-M9 v3.0.0, which originates from the presence of an arbitrary file download in the component /Basics/DownloadInpFile, which allows an attacker to request the download of an arbitrary file and gain access...

CVE-2023-6110

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials...

CVE-2024-52867

guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns e.g., for setuid and setgid programs are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, a...

D-Link DSL6740C OS Command Injection Vulnerability (CNVD-2024-45429)

The D-Link DSL6740C is a wireless VDSL router from China's AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability, which can be exploited by a remote attacker with administrator privileges to inject and execute arbitrary system commands via specific...

Microsoft Visual Studio Code Python Extension Remote Code Execution Vulnerability

Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A remote code execution vulnerability exists in Microsoft Visual Studio Code Python Extension, which can be exploited by an attacker to execute arbitrary code on a system...

D-Link DSL6740C Operating System Command Injection Vulnerability

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability, which can be exploited by a remote attacker with administrator privileges to inject and execute arbitrary system commands via specific...

Hewlett Packard Enterprise Athonet vEPC MME 安全漏洞

Hewlett Packard Enterprise Athonet vEPC MME HPE Athonet vEPC MME is a device management system from Hewlett Packard Enterprise USA. A security vulnerability exists in Hewlett Packard Enterprise Athonet vEPC MME version 11.4.0, which stems from the presence of an invalid memory access condition th...

The vulnerability of the Windows Registry component of the Microsoft Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows Registry component of the Microsoft Windows operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

Siemens SINEC INS Operating System Command Injection Vulnerability (CNVD-2024-45206)

Siemens SINEC INS is a software from Siemens, Germany, that provides centralized services for network infrastructures. Siemens SINEC INS suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary code on the underlying operating syst...

DEBIAN-CVE-2024-11117

Inappropriate implementation in FileSystem in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. Chromium security severity: Low...