505 matches found
The vulnerability of the bark_noise_hybridmp function in the psy.c component of the Vorbis multimedia library allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the barknoisehybridmp function in the psy.c component of the Vorbis multimedia library relates to the issue of writing operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and...
Design/Logic Flaw
An issue in the component postapplogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens...
Cross site request forgery (csrf)
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
Arbitrary file deletion
htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php...
CVE-2022-34550
Sims v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notifyInfo parameter...
CVE-2022-22999
CVE-2022-22999 affects Western Digital My Cloud devices and is described as a cross-site scripting vulnerability that can allow a malicious, elevated-privilege user to inject JavaScript into an authenticated user’s browser, potentially taking control of the session, stealing data, modifying setti...
CVE-2022-32096
Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component rjweaesgcmkeyunwrap. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted JWE token...
Design/Logic Flaw
The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...
The vulnerability of the administrator.cfc component in the ColdFusio software interface allows a hacker to bypass security restrictions or execute arbitrary code.
The vulnerability of the administrator.cfc component in the ColdFusion software interface is related to insufficient protection of sensitive data. Exploiting this vulnerability allows an attacker to bypass security restrictions or execute arbitrary code...
The vulnerability of the sql/sql_window.cc component of the MariaDB database management system, which allows a hacker to cause a service failure.
The vulnerability of the sql/sqlwindow.cc component in the MariaDB database management system is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
The vulnerability of the Loging component of the Siebel Core platform’s Server Framework in the Oracle Siebel CRM system allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Loging component of the Siebel Core platform’s Server Framework in the Oracle Siebel CRM system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using the HTTP...
CVE-2022-30726
CVE-2022-30726 corresponds to an unprotected DeviceSearchTrampoline component in Samsung SecSettingsIntelligence, enabling local attackers to launch SecSettingsIntelligence activities. Affected: Samsung Mobile/SecSettingsIntelligence (DeviceSearchTrampoline). Root cause: unprotected component exp...
Design/Logic Flaw
74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML...
The vulnerability of the Core component of the Oracle VM VirtualBox virtualization software for Windows operating systems allows a hacker to gain full control over the application.
The vulnerability of the Core component of the Oracle VM VirtualBox virtualization software for Windows operating systems is related to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application...
CVE-2022-28896
A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1FW130B06 allows attackers to escalate privileges to root via a crafted payload...
Vulnerability of the Cluster component: The general database management system of Oracle MySQL Cluster allows a hacker to gain full control over the application.
Vulnerability of the Cluster component: The general database management system for Oracle MySQL Cluster is vulnerable when operations are performed outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain full control over the application through various network...
The vulnerability of the Utility component of the Solaris operating system, which allows a hacker to gain access to read, modify, add, or delete data.
The vulnerability of the Utility component in the Solaris operating system exists due to insufficient checking of input data. Exploiting this vulnerability can allow a remote attacker to gain access to read, modify, add, or delete data using various network protocols...
The vulnerability of the History API component in the Cisco SD-WAN vManage network management system allows a attacker to disclose protected information.
The vulnerability of the History API component in the Cisco SD-WAN vManage network management system is related to errors in request processing. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...