PT-2024-28746 · Dahua · Dahua

Name of the Vulnerable Software and Affected Versions: Dahua products affected versions not specified Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. Recommendation...

Microsoft 3D Builder GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft 3D Builder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Word DOC File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DOC...

GLPI Request Input Cancellation Code Execution

The vulnerability of the GLPI system for handling requests and incidents is related to incorrect neutralization of input data during the generation of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted RTF format data...

GetFileWithoutZip Code Execution

The vulnerability of the GetFileWithoutZip method in the WhatsUp Gold network infrastructure monitoring system is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code ...

Secure Boot Bypass

The vulnerability of the Secure Boot protocol for Windows operating systems lies in the overflow of a buffer in dynamic memory. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by sending specially crafted data...

CVE-2024-39150

vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet...

CVE-2024-39150

vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet...

CVE-2024-39150

The browser-side Markdown editor vditor (versions 3.9.8 and earlier ) is vulnerable to an Arbitrary file read vulnerability. This flaw is triggered by processing a crafted data packet , which could allow an attacker to read files on the system. To remediate this issue, users are recommended to up...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...

Winlogon Privilege Escalation

The vulnerability of the Winlogon entry program in Windows operating systems is related to integer overflow. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially created data...

Winlogon Privilege Escalation

The vulnerability of the Winlogon entry program in Windows operating systems is related to overflow in the dynamic memory buffer. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially created data...

Win32k.sys Privilege Escalation

The vulnerability of the Win32k.sys component in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to increase their privileges using specially created data...

Denial Of Service (DoS)

ch.qos.logback:logback-classic is vulnerable to Denial Of Service DoS. The vulnerability is due to the readObject method in the LoggingEventVO class which fails to check the length of an argument array during deserialization. An attacker could send crafted data, resulting in Denial of Service DoS...

libvpx Heap Buffer Overflow DoS

The vulnerability of the vpximgalloc function in the libvpx video encoding/decoding library is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by sending specially crafted data...

PT-2024-9982 · Rockwell Automation · Rockwell Automation Arena

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena affected versions not specified Description: The issue is related to a "use after free" code execution vulnerability. This vulnerability could allow a threat actor to craft a DOE file and force the software to use a...

jettison: stack overflow in JSONObject() allows attackers to cause a Denial of Service (DoS) via crafted JSON data

A flaw was found in Jettison. Sending a specially crafted string can cause a stack-based buffer overflow. This issue may allow a remote attacker to cause a denial of service...

SolarWinds Access Rights Manager JsonSerializationBinder Code Execution

The vulnerability of the JsonSerializationBinder class in the SolarWinds Access Rights Manager ARM access control software is related to the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using specially created data...

Protobuf Heap Buffer Overflow DoS

The vulnerability of the JsonToBinaryStream function in the Protobuf data serialization protocol for the C programming language is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created JSON file...

PT-2024-26268 · Taurusxin · Ncmdump

Name of the Vulnerable Software and Affected Versions: taurusxin ncmdump version 1.3.2 Description: The issue allows attackers to cause a Denial of Service DoS via memory exhaustion by supplying a crafted .ncm file. Recommendations: For version 1.3.2, consider avoiding the use of crafted .ncm fil...