Buffer overflow

Qihoo 360 https://www.360.cn/ Qihoo 360 Safeguard https://www.360.cn/ Qihoo 360 Total Security http://www.360totalsecurity.com/ is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: This is a set of vulnerabilities affecting popular software, "360...

CVE-2021-33971

The CVE-2021-33971 entry applies to Qihoo 360 products (360 Safeguard, 360 Total Security, and 360 Safe Browser/Chrome). The vulnerability family is a buffer overflow that enables local arbitrary code execution. Affected versions include 360 Safeguard 12.1.0.1004–13.1.0.1001, 360 Total Security 1...

The vulnerability in the web interface of Hirschmann BAT-C2’s WLAN-client microprogramming software allows a hacker to perform arbitrary actions.

The vulnerability of the web interface for managing WLAN client micro-programming software Hirschmann BAT-C2 exists due to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

immudb 数据伪造问题漏洞

Immudb is a database with built-in cryptographic proof and authentication. A data forgery issue vulnerability exists in codenotary immudb versions prior to 1.4.1, which stems from a client SDK that does not validate the UUID and can accept any value reported by the server, which can be exploited ...

PT-2022-23200 · Immudb · Immudb

Name of the Vulnerable Software and Affected Versions: immudb versions prior to 1.4.1 Description: immudb is a database with built-in cryptographic proof and verification. A malicious immudb server can provide a falsified proof that will be accepted by the client SDK, signing a falsified...

GHSA-7R9X-QRPR-3CXW mofh Vulnerable to Improper Restriction of XML External Entity Reference

The xml.etree.ElementTree module that mofh used up until version 1.0.1 implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to: - Billion Laughs attack: It is a type of denial-of-service attack aimed at XML parsers. It uses multiple leve...

GHSA-P5PC-M4Q7-7QM9 Helm Unsafe Link Following

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...

CVE-2022-25165

An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service running as SYSTEM...

Adding Akamai Shared Domains to the Public Suffix List

Akamai plans to submit a number of our shared domains to the “PRIVATE” section of the Public Suffix List PSL at some point on or after March 31, 2022. The PSL contains multi-party domain suffixes and is used by a wide range of client software for example, web browsers to implement policy decision...

Accops HyWorks安全漏洞

Accops HyWorks is a suite of solutions consisting of software and hardware from Accops India. It is used to instantly and securely access enterprise applications remotely from anywhere, on any device and from any network. A buffer overflow vulnerability exists in the Accops HyWorks Windows Client...

The vulnerability of client software for various remote access protocols, such as Putty, arises from the possibility of executing operations beyond the buffer in memory. This allows attackers to cause service failures.

The vulnerability of client software against various remote access protocols like Putty is related to an error in exiting the operation beyond the buffer in memory. This caused the window to repeatedly change its header at high speeds. Exploiting this vulnerability could allow a malicious actor t...

Security Bulletin: A vulnerability in the GSKit component of Client Software Development Kit (CSDK) (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit, component of Informix Client Software Development Kit CSDK Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could exploit...

Vulnerabilities fixed in Cisco Webex Meetings and Webex Server

Cisco has fixed vulnerabilities in Webex Meetings, Webex Meetings Server, Webex Teams and Webex client software. The vulnerabilities allow a malicious person, possibly remotely, to able to launch attacks that result in the following categories of damage: Circumvention of security measure. Remote...

Mozilla Thunderbird has an unspecified vulnerability (CNVD-2021-54708)

Mozilla Thunderbird is a set of email client software from the Mozilla Foundation that is separate from the Mozilla Application Suite. Mozilla Thunderbird has a security vulnerability that could be exploited by remote attackers to bypass implemented security restrictions...

CVE-2021-1519: Improper Input Validation

A vulnerability in the interprocess communication IPC channel of Cisco AnyConnect Secure Mobility Client Software could allow an authenticated, local attacker to overwrite VPN profiles on an affected device. The vulnerability is due to insufficient validation of user-supplied input. An attacker...

1E Client elevation of privilege vulnerability (CNVD-2021-02033)

1E Client is an agent-less endpoint management software from 1E 1E Client USA. An elevation of privilege vulnerability exists in 1E Client version 5.0.0.745. The vulnerability stems from the Inventory module not properly handling unreferenced paths. An authenticated attacker can exploit this...

Command Execution Vulnerability in Homework Help Live Classes Student Side PC Client Software

Homework Help Live Classes is a premium online live tutoring product under Homework Help. Homework Help Live Classes student-side pc client software has a command execution vulnerability that can be exploited by an attacker to inject an executable DLL file into the client process. An attacker can...

Command Execution Vulnerability in Driver's License Client Software

Driver's test is a professional software for learning traffic regulations. There is a command execution vulnerability in the Driving Exam Bao Dian client software, which can be exploited by an attacker to inject an executable DLL file into the client process to perform arbitrary functions...

Ape Programming client software suffers from a DLL hijacking vulnerability

Ape Programming is a children's programming learning tool with a beautiful interface, practical functions and convenient operation. Ape Programming client software has a DLL hijacking vulnerability, which can be exploited by an attacker to inject an executable DLL file into the client process to...

Vulnerability in client (CVE-2020-25696)

psql's \gset allows overwriting specially treated variables The \gset meta-command, which sets psql variables based on query results, does not distinguish variables that control psql behavior. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute...