The vulnerability of the GetFileWithoutZip method in the network infrastructure monitoring system WhatsUp Gold allows a hacker to execute arbitrary code on the server.

The vulnerability of the GetFileWithoutZip method in the WhatsUp Gold network infrastructure monitoring system is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code ...

Microsoft 3D Builder GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft 3D Builder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows a perpetrator to execute arbitrary code.

The vulnerability of the GLPI system for handling requests and incidents is related to incorrect neutralization of input data during the generation of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted RTF format data...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with Windows, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Secure Boot protocol for Windows operating systems lies in the overflow of a buffer in dynamic memory. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by sending specially crafted data...

CVE-2024-39150

vditor, version 3.9.8 and earlier, is vulnerable to an Arbitrary file read via a crafted data packet. The issue is confirmed across multiple sources (NVD/Red Hat/CVE ecosystem). Affected component: vditor (frontend/Markdown editor). Root cause details are not explicitly provided in the extracted ...

CVE-2024-39150

vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet...

qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...

The vulnerability of the Winlogon entry program in Windows operating systems allows attackers to elevate their privileges.

The vulnerability of the Winlogon entry program in Windows operating systems is related to overflow in the dynamic memory buffer. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially created data...

The vulnerability of the Winlogon entry program in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Winlogon entry program in Windows operating systems is related to integer overflow. Exploiting this vulnerability can allow an attacker to enhance their privileges using specially created data...

The vulnerability of the Win32k.sys component in Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to increase their privileges using specially created data...

Denial Of Service (DoS)

ch.qos.logback:logback-classic is vulnerable to Denial Of Service DoS. The vulnerability is due to the readObject method in the LoggingEventVO class which fails to check the length of an argument array during deserialization. An attacker could send crafted data, resulting in Denial of Service DoS...

The vulnerability of the vpx_img_alloc() function in the libvpx video encoding/decoding library allows a perpetrator to execute arbitrary code.

The vulnerability of the vpximgalloc function in the libvpx video encoding/decoding library is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by sending specially crafted data...

PT-2024-9982 · Rockwell Automation · Rockwell Automation Arena

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena affected versions not specified Description: The issue is related to a "use after free" code execution vulnerability. This vulnerability could allow a threat actor to craft a DOE file and force the software to use a...

jettison: stack overflow in JSONObject() allows attackers to cause a Denial of Service (DoS) via crafted JSON data

A flaw was found in Jettison. Sending a specially crafted string can cause a stack-based buffer overflow. This issue may allow a remote attacker to cause a denial of service...

The vulnerability of the JsonSerializationBinder class in the SolarWinds Access Rights Manager (ARM) access control software allows a perpetrator to execute arbitrary code.

The vulnerability of the JsonSerializationBinder class in the SolarWinds Access Rights Manager ARM access control software is related to the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using specially created data...

The vulnerability of the JsonToBinaryStream() function in the Protobuf data serialization protocol for the C programming language allows a attacker to execute arbitrary code.

The vulnerability of the JsonToBinaryStream function in the Protobuf data serialization protocol for the C programming language is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created JSON file...

PT-2024-26268 · Taurusxin · Ncmdump

Name of the Vulnerable Software and Affected Versions: taurusxin ncmdump version 1.3.2 Description: The issue allows attackers to cause a Denial of Service DoS via memory exhaustion by supplying a crafted .ncm file. Recommendations: For version 1.3.2, consider avoiding the use of crafted .ncm fil...

The vulnerability of the R programming language interpreter, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code in the target system.

The vulnerability of the R programming language interpreter is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system using specially created RDS and .rdx files...

RHEL 8 : less (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - less: crafted data can result in less -R not filtering ANSI escape sequences sent to the terminal CVE-2022-46663 No...

CVE-2022-43656 Bentley View FBX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Bentley View FBX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a...