17057 matches found
GridStack - Less critical - Cross Site Scripting - SA-CONTRIB-2023-024
This module enables you to create dynamic layouts and add sample color palettes for color selection hints via its UI. The module doesn't sufficiently sanitize the module's settings in certain scenarios leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact th...
The vulnerability of the application development environment for ISaGRAF programmable logic controllers arises from the use of an unreliable search path during the loading of dynamic libraries. This allows a hacker to execute arbitrary code.
The vulnerability in the application development environment for ISaGRAF Runtime Rockwell Automation relates to the use of an unreliable search path during the loading of dynamic libraries. Exploiting this vulnerability allows a local attacker to execute arbitrary code...
New Mockingjay Process Injection Technique Could Let Malware Evade Detection
A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers...
Privilege escalation
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of...
CVE-2023-34395 Apache Airflow ODBC Provider: Remote code execution vulnerability
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of...
PT-2023-24858
Name of the Vulnerable Software and Affected Versions Apache Airflow ODBC Provider versions prior to 4.0.0 Description A privilege escalation vulnerability exists due to controllable ODBC driver parameters in OdbcHook, allowing the loading of arbitrary dynamic-link libraries and resulting in...
The vulnerability of the DHCP service provided by microprogramming software for controllers such as APOGEE MBC, APOGEE MEC, APOGEE PXC, Desigo PXC, TALON TC, and the operating system Nucleus allows a perpetrator to trigger a service failure.
The vulnerability of the DHCP service provided by microprogramming software for controllers such as APOGEE MBC, APOGEE MEC, APOGEE PXC, Desigo PXC, TALON TC, and the operating system Nucleus lies in the reading of data beyond the buffer in memory. Exploiting this vulnerability can allow a malicio...
[SECURITY] Fedora 38 Update: bind-dyndb-ldap-11.10-17.fc38
This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...
The vulnerability of the dynamically linked CrossCadWare_x64.dl library, a toolset for design and simulation in Siemens Solid Edge, allows a hacker to disclose confidential information.
The vulnerability of the dynamically linked CrossCadWarex64.dl library, which is used for design and simulation projects by Siemens Solid Edge, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to disclose confidential informatio...
RLSA-2023:3591 Important: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
CVE-2023-27908
A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...
Remote Code Execution (RCE)
Overview Affected versions of this package are vulnerable to Remote Code Execution RCE due to allowing attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed. Remediation Upgrade System.Linq.Dynamic.Core to version 1.3.0 or...
The vulnerability of the DHCP server service for Windows operating systems allows a perpetrator to disclose protected information.
The vulnerability of the DHCP server service for Windows operating systems is related to the disclosure of information. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...
Dynamic Linq vulnerable to remote code execution
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
CVE-2023-32571
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
CVE-2023-36355
TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...
CVE-2023-32571
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
Code injection
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
dynamic-professional.de Cross Site Scripting vulnerability OBB-3455720
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
