Ashlar Vellum Cobalt 缓冲区错误漏洞

Ashlar Vellum Cobalt is a parameter-based computer-aided design and 3D modeling program from Ashlar. Ashlar Vellum Cobalt suffers from a buffer error vulnerability that stems from a lack of proper validation of user-supplied data. An attacker could exploit the vulnerability to execute code in the...

Simple Chat System 注入漏洞

Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that stems from a lack of adequate validation of the input of the id parameter in the /admin/updateuser.php file. No details of the vulnerability are available at this time...

Ashlar Vellum Cobalt 安全漏洞

Ashlar Vellum Cobalt is a parameter-based computer-aided design and 3D modeling program from Ashlar, Inc. A security vulnerability exists in Ashlar Vellum Cobalt that stems from the failure to properly validate the length of user-supplied data before copying it to a stack-based buffer. An attacke...

Arista NG Firewall 操作系统命令注入漏洞

Arista NG Firewall is a WEB firewall from Arista USA. Arista NG Firewall suffers from an operating system command injection vulnerability that stems from a lack of proper validation before executing a system call using a user-supplied string, resulting in a command injection remote code execution...

PT-2024-17488 · Horner Automation · Cscape

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue occurs in the parsing of CSP files due to the lack of proper validation of user-supplied data. This could allow reading past the end of...

CVE-2024-11950

XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of XnSoft XnView Classic. User interaction is required to exploit this vulnerability in that the target must...

About Elevation of Privilege – PAN-OS (CVE-2024-9474) vulnerability

About Elevation of Privilege - PAN-OS CVE-2024-9474 vulnerability. An attacker with PAN-OS administrator access to the management web interface can perform actions on the Palo Alto device with root privileges. Linux commands can be injected via unvalidated input in script. The need for...

WordPress plugin InPost Gallery 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

Wyze Cam 操作系统命令注入漏洞

Wyze Cam Wyze Labs is a series of cameras from Wyze USA. Wyze Cam v3 suffers from an operating system command injection vulnerability that stems from a lack of proper validation before executing a system call using a user-supplied string. An attacker exploiting this vulnerability could execute...

PT-2024-10927 · Qualcomm · Snapdragon +73

Name of the Vulnerable Software and Affected Versions: Audio module affected versions not specified Description: The issue is related to a possible out of bound access in the audio module due to the lack of validation of user-provided input. Recommendations: At the moment, there is no information...

PT-2024-17038 · Irfanview · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this issue, where the target must visit a...

PT-2024-32621 · Myscada · Myscada Mypro Manager

Name of the Vulnerable Software and Affected Versions: mySCADA myPRO Manager affected versions not specified Description: A parameter within a command does not properly validate input, which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. Th...

Wazifa System control.php File SQL Injection Vulnerability

Wazifa System is a content management system. Wazifa System suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in the parameter to of the file /controllers/control.php. An attacker can exploit this vulnerability to execute illegal...

CVE-2024-48954

CVE-2024-48954 affects Logpoint before 7.5.0. The issue arises from unvalidated input during the EventHub Collector setup by an authenticated user, enabling remote code execution. The description consistently ties the vulnerability to the EventHub Collector setup flow and authenticated input hand...

CVE-2024-50333

CVE-2024-50333 pertains to SuiteCRM where user input is not validated and is written to the filesystem. The issue arises from ParserLabel::addLabels(), which can write attacker-controlled data into a custom language file that is included at runtime. Affects SuiteCRM versions prior to 7.14.6 and 8...

PT-2024-34146

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1 Description: The issue arises from the lack of validation of user input, which is then written to the filesystem. The ParserLabel::addLabels function can be exploited to write...

Code-Projects Wazifa System SQL注入漏洞

Wazifa System is a content management system. Wazifa System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter username in the file /controllers/logincontrol.php. An attacker can use this vulnerability to...

Unsafe Deserialization

admidio/admidio is vulnerable to an Unsafe Deserialization. The vulnerability is due to improper handling of user input during the deserialization process. Specifically, it occurs when the application does not adequately validate or sanitize serialized data before converting it back into objects...

Tenda RX9 Pro和Tenda RX9 安全漏洞

Both the Tenda RX9 Pro and the Tenda RX9 are a wireless router from the Chinese company Tenda. The Tenda RX9 Pro and Tenda RX9 suffer from a buffer overflow vulnerability that originates from the list parameter in the sub42EA38 function on the /goform/SetVirtualServerCfg page that fails to...

CVE-2024-49902

In the Linux kernel, the following vulnerability has been resolved: jfs: check if leafidx greater than num leaves per dmap tree syzbot report a out of bounds in dbSplit, it because dmtleafidx greater than num leaves per dmap tree, add a checking for dmtleafidx in dbFindLeaf. Shaggy: Modified sani...