17091 matches found
CVE-2022-31467
A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...
Quick Heal 代码问题漏洞
Quick Heal is an antivirus software from Quick Heal that provides IT security solutions for your PC, Mac, phone, tablet and corporate network. A code issue vulnerability exists in versions prior to Quick Heal Total Security 12.1.1.27, which stems from a lack of privilege control during applicatio...
CVE-2022-29028
A vulnerability has been identified in JT2Go All versions V13.3.0.3, Teamcenter Visualization V13.3 All versions V13.3.0.3, Teamcenter Visualization V14.0 All versions V14.0.0.1. The TiffLoader.dll is vulnerable to infinite loop condition while parsing specially crafted TIFF files. An attacker...
CVE-2022-28965
Multiple DLL hijacking vulnerabilities via the components instup.exe and wscproxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service DoS via a crafted DLL file...
CVE-2022-28964
An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 build 21.11.6809.528 allows attackers to cause a Denial of Service DoS via a crafted DLL file...
GHSA-HP87-P4GW-J4GQ vulnerabilities
Vulnerabilities for packages: thanos-operator, dynamic-localpv-provisioner...
GHSA-HP87-P4GW-J4GQ vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner-fips, thanos-operator, dynamic-localpv-provisioner, thanos-operator-fips...
Avast Premium Security 代码问题漏洞
Avast Premium Security is an application from the Czech company Avast. Avast Premium Security suffers from a DLL hijacking vulnerability that originates when the instup.exe and wscproxy.exe processes attempt to load a DLL by failing to specify the absolute path to the DLL. An attacker could use...
The vulnerability of the Git distributed version control system’s uninstaller allows a hacker to increase their privileges.
The vulnerability of the Git distributed version control system’s uninstaller is related to an uncontrolled element in the loading process of DLL libraries. Exploiting this vulnerability can allow attackers to enhance their privileges using specially created malicious files with the extension .dl...
CVE-2022-28948 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner-fips, thanos-operator, dynamic-localpv-provisioner, thanos-operator-fips...
CVE-2022-28948 vulnerabilities
Vulnerabilities for packages: thanos-operator, dynamic-localpv-provisioner...
SQL injetction
Description SQL injection exists in the camptocamp/terraboard. Among all APIs there is an API routed to /api/search/attribute, whose corresponding method is api.SearchAttribute. In the api.SearchAttribute method, the program takes the request parameters and passes them into the db.SearchAttribute...
The vulnerability of the ViPNet Client’s software-hardware protection system lies in its ability to replace the dynamic library, allowing an attacker to execute arbitrary code.
The vulnerability of the ViPNet Client software lies in the possibility of replacing the dynamic library. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially crafted dynamic library...
The vulnerability of the pre-processing processor Simcenter Femap, caused by buffer overflow in dynamic memory, allows a hacker to execute code within the context of the current process.
The vulnerability of the pre-processing processor Simcenter Femap arises due to an overflow in the buffer in the dynamic memory. Exploiting this vulnerability allows a malicious actor to execute code within the context of the current process while analyzing specially created NEU files...
GHSA-V4VM-GJ2X-6QHM DCE extension for Typo3 Discloses Environment Information
The default configuration in the Dynamic Content Elements dce extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request...
GHSA-56F8-G68R-J699 Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting XSS in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation DMI is enabled, the action name is generated dynamically...
Cross-site Scripting in Apache Struts
Multiple Cross-Site Scripting XSS in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation DMI is enabled, the action name is generated dynamically...
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the SERVER superglobal array. An attacker can overwrite entries in this array by sending crafted POST parameters. Remediation Upgrade com.caucho:resin to...
Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
GHSA-MRFM-JXGF-2H6V Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...