PT-2024-28749 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products. After obtaining an ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface wit...

PT-2024-28751 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products, allowing attackers to send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash...

PT-2024-28750 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products, allowing attackers to send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash...

PT-2024-28748 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface wi...

PT-2024-28746 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. Recommendation...

Microsoft Word DOC File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DOC...

The vulnerability of the GetFileWithoutZip method in the network infrastructure monitoring system WhatsUp Gold allows a hacker to execute arbitrary code on the server.

The vulnerability of the GetFileWithoutZip method in the WhatsUp Gold network infrastructure monitoring system is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code ...

Microsoft 3D Builder GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft 3D Builder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows a perpetrator to execute arbitrary code.

The vulnerability of the GLPI system for handling requests and incidents is related to incorrect neutralization of input data during the generation of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted RTF format data...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with Windows, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Secure Boot protocol for Windows operating systems lies in the overflow of a buffer in dynamic memory. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by sending specially crafted data...

CVE-2024-39150

vditor, version 3.9.8 and earlier, is vulnerable to an Arbitrary file read via a crafted data packet. The issue is confirmed across multiple sources (NVD/Red Hat/CVE ecosystem). Affected component: vditor (frontend/Markdown editor). Root cause details are not explicitly provided in the extracted ...

CVE-2024-39150

vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...

The vulnerability of the Winlogon entry program in Windows operating systems allows attackers to elevate their privileges.

The vulnerability of the Winlogon entry program in Windows operating systems is related to overflow in the dynamic memory buffer. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially created data...

The vulnerability of the Winlogon entry program in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Winlogon entry program in Windows operating systems is related to integer overflow. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially created data...

The vulnerability of the Win32k.sys component in Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to increase their privileges using specially created data...

Denial Of Service (DoS)

ch.qos.logback:logback-classic is vulnerable to Denial Of Service DoS. The vulnerability is due to the readObject method in the LoggingEventVO class which fails to check the length of an argument array during deserialization. An attacker could send crafted data, resulting in Denial of Service DoS...

The vulnerability of the vpx_img_alloc() function in the libvpx video encoding/decoding library allows a perpetrator to execute arbitrary code.

The vulnerability of the vpximgalloc function in the libvpx video encoding/decoding library is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by sending specially crafted data...

PT-2024-9982 · Rockwell Automation · Rockwell Automation Arena

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena affected versions not specified Description: The issue is related to a "use after free" code execution vulnerability. This vulnerability could allow a threat actor to craft a DOE file and force the software to use a...

jettison: stack overflow in JSONObject() allows attackers to cause a Denial of Service (DoS) via crafted JSON data

A flaw was found in Jettison. Sending a specially crafted string can cause a stack-based buffer overflow. This issue may allow a remote attacker to cause a denial of service...