2210 matches found
U.S. Department of State: Impact of Using the PHP Function "phpinfo()" on System Security - PHP info page disclosure
Sensitive information such as the exact PHP version, operating system and its version, internal IP addresses, server environment variables, and loaded PHP extensions and their configurations could be revealed by using the PHP function "phpinfo". This could potentially be exploited by attackers to...
TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18951)
The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from the lack of size checking of input data in the setlogonum parameter of the icpsetlogoimg sub41DBF4 function, which can be exploited by an attacker to execute...
TRENDnet TEW-755AP stack overflow vulnerability (CNVD-2023-18955)
The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a stack overflow vulnerability that stems from a lack of size checking of input data in the wpsstaenrolleepin parameter in the setstaenrolleepin5g function, which can be exploited by an attacker to execute...
Tenda A15 wrlPwd_5g Parameter Stack Overflow Vulnerability
Tenda A15 is a WiFi extender from Tenda, China. A stack overflow vulnerability exists in the Tenda A15 wrlPwd5g parameter, which is caused by an incorrect boundary check performed by /goform/WifiBasicSet. By sending an excessively long string using the wrlPwd5g parameter, a remote attacker could...
Remote Code Execution
@editorjs/editorjs is vulnerable to remote code execution. An attacker is able to upload and execute malicious code on the system via pasted input into wrapper's innerHTML method...
MCCrash: Cross-platform DDoS botnet targets private Minecraft servers
Malware operations continue to rapidly evolve as threat actors add new capabilities to existing botnets, increasingly targeting and recruiting new types of devices. Attackers update malware to target additional operating systems, ranging from PCs to IoT devices, growing their infrastructure...
CVE-2022-46140
Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system...
Important: python38
Issue Overview: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. CVE-2022-37454 Affected...
CVE-2022-46338
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data...
Google Chrome Accessibility code execution vulnerability
Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome Accessibility, which is caused by free usage in Accessibility. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service...
Unspecified Vulnerability in SolarWinds Security Event Manager
SolarWinds Security Event Manager SolarWinds SEM is an American SolarWinds, Inc. for forensics and troubleshooting, as well as a tool to help you manage log data. A security vulnerability exists in SolarWinds Security Event Manager 2022.2 and prior versions that stems from disclosing HTTP methods...
Red Lion Crimson
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Red Lion Controls Equipment: Crimson Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain user credential hashes. 3...
CVE-2022-34354
IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424...
CVE-2022-45388
CVE-2022-45388 affects Jenkins Config Rotator Plugin (versions 2.0.1 and earlier). The issue is an unrestricted file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with a .xml extension on the Jenkins controller filesystem. Publicly available ...
Microsoft Excel Remote Code Execution Vulnerability (CNVD-2023-53904)
Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A remote code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...
Democritus Project d8s-timer code execution vulnerability (CNVD-2022-84131)
Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A code execution vulnerability exists in Democritus Project d8s-timer, which stems from its inclusion of a potential code execution backdoor inserted by a third party. An...
The vulnerability of the Windows operating system’s kernel, which allows a hacker to elevate their privileges within the system
The vulnerability of the Windows operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain increased privileges within the system...
IBM Business Automation Workflow Information Disclosure Vulnerability
IBM Business Automation Workflow is a workflow automation solution from IBM in the United States. The product is primarily used for workflow management, compliance management, and has features such as workflow visibility and scalability.An information disclosure vulnerability exists in multiple...
Arbitrary Code Execution
mruby is vulnerable to arbitrary code executions. The vulnerability exists due to out-of-bounds reads in mrbobjiskindof in which allows an attacker to execute arbitrary codes in the system...