The vulnerability of the Visual Analyzer (Snappy) component of the Oracle Business Intelligence Enterprise Edition software platform, which allows a hacker to trigger a service failure.

The vulnerability of the Visual Analyzer Snappy component of the Oracle Business Intelligence Enterprise Edition software platform is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2024-490)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-490 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

zeek:zeek-smtp-fuzzer: Heap-buffer-overflow in zeek::analyzer::smtp::detail::parse_bdat_arg

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=6288273634820096 Project: zeek Fuzzing Engine: libFuzzer Fuzz Target: zeek-smtp-fuzzer Job Type: libfuzzerasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x603000e822cf...

Access analysis CGI An-Analyzer vulnerable to open redirect

Overview Access analysis CGI An-Analyzer provided by ANGLERSNET Co,.Ltd. contains an open redirect vulnerability CWE-601. Tomoomi Iwata of Information-technology Promotion Agency, Japan reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

Open redirect

Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary websites and conduct phishing attacks via a specially crafted URL...

CVE-2024-22113

CVE-2024-22113 affects Access analysis CGI An-Analyzer from ANGLERSNET Co., Ltd. The vulnerability is an open redirect (CWE-601) in the CGI component, allowing remote unauthenticated attackers to redirect users to arbitrary websites via a specially crafted URL, enabling phishing scenarios. Root c...

CVE-2024-22113

Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary websites and conduct phishing attacks via a specially crafted URL...

CVE-2024-22113: URL Redirection to Untrusted Site

Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary websites and conduct phishing attacks via a specially crafted URL...

PT-2024-19214 · Unknown · Access Analysis Cgi An-Analyzer

Name of the Vulnerable Software and Affected Versions: Access analysis CGI An-Analyzer versions prior to 2023 December 31 Description: The issue allows a remote unauthenticated attacker to redirect users to arbitrary websites and conduct phishing attacks via a specially crafted URL...

zeek:zeek-smtp-fuzzer: Segv on unknown address in zeek::analyzer::smtp::SMTP_Analyzer::DeliverStream

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=4789219251781632 Project: zeek Fuzzing Engine: honggfuzz Fuzz Target: zeek-smtp-fuzzer Job Type: honggfuzzasanzeek Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

GTKWave FST fstReaderIterBlocks2 vesc allocation integer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1790 GTKWave FST fstReaderIterBlocks2 vesc allocation integer overflow vulnerability January 8, 2024 CVE Number CVE-2023-35992 SUMMARY An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115,...

GTKWave LXT2 lxt2_rd_iter_radix shift operation integer underflow vulnerabilities

Talos Vulnerability Report TALOS-2023-1824 GTKWave LXT2 lxt2rditerradix shift operation integer underflow vulnerabilities January 8, 2024 CVE Number CVE-2023-39413,CVE-2023-39414 SUMMARY Multiple integer underflow vulnerabilities exist in the LXT2 lxt2rditerradix shift operation functionality of...

GTKWave FST FST_BL_GEOM parsing maxhandle integer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1777 GTKWave FST FSTBLGEOM parsing maxhandle integer overflow vulnerability January 8, 2024 CVE Number CVE-2023-32650 SUMMARY An integer overflow vulnerability exists in the FSTBLGEOM parsing maxhandle functionality of GTKWave 3.3.115, when compiled as a 32-b...

GTKWave VCD get_vartoken realloc use-after-free vulnerabilities

Talos Vulnerability Report TALOS-2023-1806 GTKWave VCD getvartoken realloc use-after-free vulnerabilities January 8, 2024 CVE Number CVE-2023-37576,CVE-2023-37577,CVE-2023-37573,CVE-2023-37578,CVE-2023-37575,CVE-2023-37574 SUMMARY Multiple use-after-free vulnerabilities exist in the VCD getvartok...

GTKWave VZT vzt_rd_get_facname decompression out-of-bounds write vulnerabilities

Talos Vulnerability Report TALOS-2023-1813 GTKWave VZT vztrdgetfacname decompression out-of-bounds write vulnerabilities January 8, 2024 CVE Number CVE-2023-38649,CVE-2023-38648 SUMMARY Multiple out-of-bounds write vulnerabilities exist in the VZT vztrdgetfacname decompression functionality of...

GTKWave FST LEB128 varint stack-based buffer overflow vulnerabilities

Talos Vulnerability Report TALOS-2023-1783 GTKWave FST LEB128 varint stack-based buffer overflow vulnerabilities January 8, 2024 CVE Number CVE-2023-35704,CVE-2023-35703,CVE-2023-35702 SUMMARY Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of...

VulnCheck KEV: CVE-2018-17283

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

The vulnerability of the RFC3164 analyzer in the Syslog-ng logging processing tool allows a attacker to trigger a service failure.

The vulnerability of the RFC3164 analyzer used by the Syslog-ng logging tool is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...

Script to Automate Implementation of Security & Compliance Analyzer Recommendations

Article Applicability This article and its script are relevant to Windows-based deployments of Veeam Backup & Replication. Purpose This article provides information regarding automating the configuration of the Veeam Backup Server according to practices suggested in the Security & Compliance...

CVE-2023-6194

In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external entities. This means that if a user chooses to use a malicious report definition XML file containing an external entity reference to...