327 matches found
Improper restriction of XML external entity references (XXE) in Proself
Overview Proself provided by North Grid Corporation improperly restricts XML external entity references XXE CWE-611. The developer states that attacks exploiting this vulnerability have been observed. North Grid Corporation reported this vulnerability to JPCERT/CC to notify users of its solution...
Apache Druid < 0.20.2 RCE
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
Information Disclosure
RestrictedPython is vulnerable to Information Disclosure. The vulnerability arises due to the format functionality in Python which allows someone controlling the format string to "read" data from objects, including sensitive information. This vulnerability could potentially allow an attacker to...
CVE-2023-38030
Saho’s attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions...
The vulnerability of the software platform for managing operational data, related to errors in system settings or configuration, allows a perpetrator to read and modify arbitrary data in various system catalogs. This vulnerability enables unauthorized access and manipulation of system functions.
The vulnerability of the software platform for operating data management in ABB Ability zenon relates to errors in system settings or configuration. Exploiting this vulnerability can allow attackers to read and update arbitrary data in various system catalogs...
AZL-27465 CVE-2023-22048 affecting package mysql for versions less than 8.0.34-1
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...
CVE-2023-21983
Vulnerability in the Application Express Administration product of Oracle Application Express component: None. Supported versions that are affected are Application Express Administration: 18.2-22.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to...
The vulnerability of the Paceart Messaging Service in the Paceart Optima cardiac monitoring system allows a perpetrator to gain unauthorized access to read, modify, or delete data, execute arbitrary code, or trigger a service failure.
The vulnerability of the Paceart Messaging Service in the Paceart Optima cardiac monitoring system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to read, modify, or delete data, execute...
PT-2023-3472 · Ipswitch · Moveit Transfer
Name of the Vulnerable Software and Affected Versions: MOVEit Transfer versions prior to 2020.1.11 12.1.11 MOVEit Transfer versions prior to 2021.0.9 13.0.9 MOVEit Transfer versions prior to 2021.1.7 13.1.7 MOVEit Transfer versions prior to 2022.0.7 14.0.7 MOVEit Transfer versions prior to 2022.1...
Code injection
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens...
The vulnerability of the 3D model texturing software Adobe Substance 3D Painter lies in the reading of data beyond the allowed buffer size limits, allowing an attacker to execute arbitrary code.
The vulnerability of the 3D model texturing software Adobe Substance 3D Painter lies in the reading of data beyond the allowed buffer size. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
The vulnerability of Adobe Dimension’s 3D design software lies in its ability to read data beyond the buffer limit in memory, allowing an attacker to execute arbitrary code.
The vulnerability of Adobe Dimension’s 3D design software relates to reading data beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2023-22805 CVE-2023-22805
LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device...
CVE-2023-22805
CVE-2023-22805 affects LS ELECTRIC XBC-DN32U with OS 01.80, exposing improper access control in the read-prohibition feature. This could allow a remote attacker to set the feature to lock users out from reading data. The linked sources describe the affected product, version, and risk; mitigations...
SUSE CVE-2017-3586
Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/J. Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Whil...
SUSE CVE-2017-10277
Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/Net. Supported versions that are affected are 6.9.9 and earlier. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors...
New BOLDMOVE Backdoor uses FortiOS vulnerability for initial access
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A suspected China-nexus campaign has exploited a vulnerability in Fortinets FortiOS SSL-VPN, known as CVE-2022-42475. The exploitation was believed to have occurred as early as October 2022 and the targe...
SUSE-SU-2022:3984-1 Security update for freerdp
This update for freerdp fixes the following issues: - CVE-2022-39282: Fix to init data read by /parallel command line switch. bsc1204258 - CVE-2022-39283: Fix to prevent video channel from reading uninitialized data. bsc1204257...
Hospital Management System SQL注入漏洞
The Hospital Management System HMS is a computer system that helps manage healthcare-related information and helps healthcare providers do their jobs effectively. A SQL injection vulnerability exists in Hospital Management System v1.0, which originates from a security issue with the Username and...
