CVE-2023-39075

Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R builds 11.10.2021 to 16.01.2023 allows attackers to crash the infotainment system by sending arbitrary USB data via a USB device...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. A malicious client can cause an error against the destination's size limit, which would incorrectly be attributed to the destination rather than the client. This could allow an attacker to send large amounts of da...

CVE-2023-33958 Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The...

Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack

Impact An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running notation verify. Patches The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade the...

The Importance of Managing Your Data Security Posture

Data security is reinventing itself. As new data security posture management solutions come to market, organizations are increasingly recognizing the opportunity to provide evidence-based security that proves how their data is being protected. But what exactly is data security posture, and how do...

The Importance of Managing Your Data Security Posture

Data security is reinventing itself. As new data security posture management solutions come to market, organizations are increasingly recognizing the opportunity to provide evidence-based security that proves how their data is being protected. But what exactly is data security posture, and how do...

CVE-2022-38472

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird 102.2,...

The vulnerability of the hb-ot-shape-fallback.cc component in the Harfbuzz text transformation library, which allows a hacker to trigger a service failure.

The vulnerability of the hb-ot-shape-fallback.cc component in the Harfbuzz text transformation library is related to a numerical overflow in the hb-ot-shape-fallback.cc file. Exploiting this vulnerability could allow an attacker to cause a service failure by sending specially crafted data to the...

The vulnerability of the object_common1 function in the PHP programming language, related to reading beyond the buffer in memory, allows attackers to trigger a service failure.

The vulnerability of the objectcommon1 function in the PHP programming language is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure by using specially created serialized data, which are incorrectly processed...

Bentley Systems MicroStation 安全漏洞

Bentley MicroStation CONNECT is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, U.S.A. An out-of-bounds write vulnerability exists in Bentley MicroStation CONNECT, which could be exploited by an attacker to trigger, via crafted data in a PN image an out-of-bounds...

Online Reviewer Management System 1.0 Cross Site Scripting

Exploit Title: Online Reviewer Management System Persistent Cross Site Scripting Exploit Author: th3d1gger Vendor Homepage: https://sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/reviewer0.zip Version: 1.0 Tested on Windows 10 @attack request...

CVE-2021-3151

i-doit before 1.16.0 is affected by Stored Cross-Site Scripting XSS issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via CMONITORINGCONFIGTITLE, SM2CMONITORINGCONFIGTITLE, CMONITORINGCONFIGPATH, SM2CMONITORINGCONFIGPATH, CMONITORINGCONFIGADDRESS, or...

The vulnerability of the rtslib-fb library is related to incorrect default access rights settings, which allow attackers to execute arbitrary code.

The vulnerability in the /etc/target/saveconfig.json file of the rtslib-fb library is related to incorrect default access permissions settings. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending specially crafted data to the application...

CVE-2019-3979: Insufficient Verification of Data Authenticity

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's...

The vulnerability of the websSecurityHandler function in the MOXA EDR-810 industrial router’s web server allows a hacker to execute arbitrary code.

The vulnerability of the websSecurityHandler function offset 0x1B4B0 in the web server jffs2-root\fs1\magicP\WebServer\webs of the MOXA EDR-810 industrial router is caused by the lack of checking the size of the data being copied into a buffer of 0x200 bytes. Exploiting this vulnerability allows ...

openSUSE Security Update : hostapd (openSUSE-2018-1293)

hostapd was updated to fix following security issue : - CVE-2018-14526: Ignore unauthenticated encrypted EAPOL-Key data bsc1104205 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

HEVD kernel vulnerability training-with Windows play-bug warning-the black bar safety net

For this training of the research study will kernel vulnerability principle, the use of the way, under Windows many common data structures have a preliminary understanding, from the open Ring0 gate. HEVD project address: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver For the kernel...

UBUNTU-CVE-2015-8217

The ffhevcparsesps function in libavcodec/hevcps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows remote attackers to cause a denial of service out-of-bounds array access or possibly have unspecified other impact via crafted High Efficiency Video Coding HEVC da...

UBUNTU-CVE-2015-2694

The kdcpreauth modules in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing 1 zero bytes of data or 2 an arbitrary realm name,...

DEBIAN-CVE-2014-8542

libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service out-of-bounds access or possibly have unspecified other impact via crafted JV data...