Out-of-bounds

The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC UA Tunneller versions prior to 6.3.0.8233...

CVE-2020-27299

The CVE-2020-27299 entry affects the OPC UA Tunneller (Matrikon/Honeywell) before version 6.3.0.8233. It is an out-of-bounds read vulnerability that may allow an attacker to obtain and disclose sensitive data or cause the device to crash. Red Hat/CISA documents confirm the product and version aff...

CVE-2020-27299

The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash on the OPC UA Tunneller versions prior to 6.3.0.8233...

The vulnerability of the Core component in Oracle VM VirtualBox allows a hacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Core component in Oracle VM VirtualBox exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google and the Open Handheld Consortium Google. An input validation error vulnerability exists in A2DPGetCodecType for Google Android, which arises from the possibility that a program could read out-of-bounds due to improper input...

Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure

The plugin did not check for user capability in the dmmexportdonations function, allowing any authenticated user to export a CSV file containing all donors personal information. GET /wp-admin/admin-post.php?action=dmmexport...

PT-2021-5771

Name of the Vulnerable Software and Affected Versions GnuTLS affected versions not specified Description A flaw was found in the client send params function of the lib/ext/pre shared key.c component, related to a use after free issue. This may lead to memory corruption and other potential...

Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure

The plugin did not check for user capability in the dmmexportdonations function, allowing any authenticated user to export a CSV file containing all donors personal information. PoC GET /wp-admin/admin-post.php?action=dmmexport...

Honeywell OPC UA Tunneller Buffer Error Vulnerability

Honeywell OPC UA Tunneller is a Honeywell application that provides reliable OPC UA connectivity across devices and domains. Honeywell OPC UA Tunneller All versions prior to 6.3.0.8233 A buffer error vulnerability exists that could allow an attacker to disclose sensitive information, remotely...

Honeywell OPC UA Tunneller Code Issue Vulnerability

Honeywell OPC UA Tunneller is a Honeywell application that provides reliable OPC UA connectivity across devices and domains. Honeywell OPC UA Tunneller All versions prior to 6.3.0.8233 A code issue vulnerability exists that could allow an attacker to disclose sensitive information, remotely execu...

Honeywell OPC UA Tunneller

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Matrikon, a subsidiary of Honeywell Equipment: OPC UA Tunneller Vulnerabilities: Heap-based Buffer Overflow, Out-of-bounds Read, Improper Check for Unusual or Exceptional Conditions, Uncontrolled...

CVE-2020-20949

Bleichenbacher's attack on PKCS 1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube UM1924. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the...

CVE-2021-2079

Vulnerability in the Oracle Configurator product of Oracle Supply Chain component: UI Servlet. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attack...

Kartpay: Disclosure of Merchant_id into the source code without entered OTP code leads to Victims MID takeover.

The System Encryption for the merchant registration was revealing the details which can be further exploitable for the Registration of the merchant. After sharing the details by the @bugera it was fixed by the team...

CVE-2020-4969

IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

Oracle Java SE 1.7.0_291 / 1.8.0_281 / 1.11.0_10 / 1.15.0_2 Information Disclosure (Windows Jan 2021 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 291, 8 Update 281, 11 Update 10, or 15 Update 2. It is, therefore, affected by an information disclosure vulnerability as referenced in the January 2021 CPU advisory. Specifically, an...

CVE-2020-20950

Bleichenbacher's attack on PKCS 1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a fully integrated set of global business management software from Oracle USA. The software provides customer relationship management, service management, financial management and other functions. iStore is one of the business can effectively build,...

Vulnerability fixed in Atlassian Crucible

A vulnerability has been fixed in Atlassian Crucible. The vulnerability allows a malicious party to obtain system data obtain. Atlassian has released updates to fix the vulnerability. fix. More information can be found on the page below: https://jira.atlassian.com/browse/CRUC-8496...

HPE Aruba Airwave Glass Code Issue Vulnerability

HPE Aruba Airwave Glass is a smart glasses device from Hewlett-Packard HPE. The HPE Aruba Airwave Glass before 1.3.3 suffers from a code issue vulnerability that stems from the presence of a server-side request forgery vulnerability via an unauthenticated endpoint, which could lead to the...