ROS-20241023-11

Vulnerability of the BufWinLeave function of the vim text editor is related to memory usage after its release. Exploitation of the vulnerability could allow an attacker to gain access to confidential information. information...

September episode of “In The Trend of VM”: 7 CVEs, fake reCAPTCHA, lebanese pagers, VM and IT annual bonuses

September episode of "In The Trend of VM": 7 CVEs, fake reCAPTCHA, lebanese pagers, VM and IT annual bonuses. Starting this month, we decided to slightly expand the topics of the videos and increase their duration. I cover not only the trending vulnerabilities of September, but also social...

The vulnerability of the sinv_check_exp component in the Virtuoso-opensource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the sinvcheckexp component in the Virtuoso-opensource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to trigger a service failure using specially created SQL...

PT-2024-29427

Name of the Vulnerable Software and Affected Versions No information is available about the vulnerable software and its affected versions. Description The issue is being actively exploited. No further details are available about the nature of the issue, potentially affected devices, or real-world...

Information Disclosure Vulnerability in Multiple Mozilla Products (CNVD-2024-46831)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. An information disclosure vulnerability exists in multiple Mozilla...

Adobe Commerce improper authentication vulnerability (CNVD-2024-41465)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from an improper authentication vulnerability that could be exploited by an attacker to cause a security feature bypass...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Jetbrains Teamcity

EN GenTeamCityExploit is a PoC tool that targets a vulnera...

Siemens Tecnomatix Plant Simulation 缓冲区错误漏洞

Tecnomatix Plant Simulation allows the modeling, simulation, exploration and optimization of logistics systems and their processes. These models allow material flow, resource utilization and logistics analysis of all manufacturing plans from global production facilities to local plants and specif...

Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

Delta Electronics DIAEnergie AM_RegReport.aspx SQL Injection Vulnerability

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China. An SQL injection vulnerability exists in Delta Electronics DIAEnergie AMRegReport.aspx, which can be exploited by an attacker to view, add, modify, or delete information in the back-end...

The vulnerability of the llcp component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the llcp component in the Linux operating system’s kernel is related to incorrect resource locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-47290

Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-9202 EDC DataSetResolver policy filtering missing

In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets = data offers another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers. However, there is the possibility to request a single...

CVE-2024-20467

Cisco IOS XE Software contains a vulnerability in the IPv4 fragmentation reassembly code that could allow an unauthenticated, remote attacker to cause a DoS by sending specific sizes of fragmented packets or via a Virtual Fragmentation Reassembly (VFR) interface. Affected devices are Cisco ASR 10...

Google Chrome Security Bypass Vulnerability (CNVD-2024-49509)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome, which can be exploited by attackers to bypass security restrictions...

webray.com.cn

It is an offensive tool for web application exploitation. The to...

PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

Arbitrary File Read Vulnerability in anysec 2nd Generation Firewall System of Shenzhen Zhongke Netway Technology Co. Ltd (CNVD-2024-41191)

Ltd. is a high-tech enterprise focusing on the research, development and production of network security products. Shenzhen Zhongke NetWizard Technology Co., Ltdanysec second-generation firewall system has an arbitrary file reading vulnerability, which can be exploited by attackers to obtain...

The vulnerability of the command-line interface of the Cisco NX-OS operating system in Cisco Nexus switches allows a perpetrator to execute arbitrary commands.

The vulnerability of the command-line interface of the Cisco NX-OS operating system in Cisco Nexus switches exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow an attacker to execute arbitrary commands on the basic operating system...

Adobe Releases Security Updates for Multiple Products

Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the...