CVE-2024-23156

A maliciously crafted 3DM file, when parsed in opennurbs.dll and ASMkern229A.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process...

CVE-2024-23156

The CVE-2024-23156 entry describes a memory corruption vulnerability triggered by parsing a malicious 3DM file in Autodesk AutoCAD (opennurbs.dll and ASMkern229A.dll). Root cause: memory corruption via write access violation in the affected DLLs, potentially enabling code execution in the current...

CVE-2024-37006

CVE-2024-37006 affects Autodesk AutoCAD (CATPRODUCT) via parsing in CC5Dll.dll. A malicious CATPRODUCT file can trigger memory corruption (write access violation) and, in combination with other vulnerabilities, may lead to code execution in the current process. CVSS/notes indicate LOCAL attack wi...

CVE-2024-37000

A maliciously crafted XB file, when parsed in pskernel.DLL through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process...

CVE-2024-23147

A maliciously crafted CATPART, XB and STEP, when parsed in ASMKERN228A.dll and ASMKERN229A.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the...

CVE-2024-23148

A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process...

CVE-2024-37000 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

A maliciously crafted XB file, when parsed in pskernel.DLL through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the context of the current process...

Autodesk AutoCAD 缓冲区错误漏洞

Autodesk AutoCAD is a set of professional 3D drawing software from the American Autodesk Corporation. A memory corruption vulnerability exists in Autodesk AutoCAD version 2024.1.4, which originates from a write access conflict when parsing a maliciously crafted CATPRODUCT file in CC5Dll.dll in th...

CVE-2024-36495: Incorrect Default Permissions

The application Faronics WINSelect Standard + Enterprise saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file: C:\ProgramData\WINSelect\WINSelect.wsd The path for the affected WINSelect Enterprise configuration file is:...

cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal “../“. This flaw allows the container to read and write to arbitrary files on the host system...

OpenPrinting CUPS Security Vulnerability

OpenPrinting CUPS is a standards-based, open source printing system for Linux® and other Unix®-like operating systems from OpenPrinting, Inc. A security vulnerability exists in OpenPrinting CUPS versions 2.4.8 and earlier, which originates when the cupsd server is started with a Listen...

TYPO3 Denial of Service in Online Media Asset Handling

Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...

TYPO3 Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

PT-2024-40199

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue arises from improper encoding of user input, making online media asset rendering for .youtube and .vimeo files susceptible to cross-site scripting. Exploitation requires a...

RHEL 7 : busybox (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - busybox: Integer underflow in archival/libarchive/decompressunlzma.c CVE-2017-15874 - The getnextblock...

RHEL 8 : gegl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gegl: write access violation geglbufferiteratereadsimple function in buffer/gegl-buffer-access.c...

TYPO3 Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

PT-2024-40019 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns the handling of online media assets, specifically .youtube and .vimeo files, in the TYPO3 backend. It is vulnerable to a denial of service, which occurs when large files wi...

CVE-2024-25975 Arbitrary File Overwrite

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is...