The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages, related to errors in processing input data, allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code by having the user open a specially crafted malicious file...

ALSA-2024:0121 Moderate: container-tools:4.0 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseable query...

Moderate: container-tools:4.0 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseable query...

PT-2024-1024 · Microsoft · Ocsp +1

Name of the Vulnerable Software and Affected Versions: Microsoft Online Certificate Status Protocol OCSP affected versions not specified Description: The issue is related to the implementation of the Online Certificate Status Protocol OCSP in Windows operating systems, specifically concerning...

PT-2024-1247 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The issue is related to synchronization errors when using a shared resource in the Windows Hyper-V hardware virtualization system. This can be exploited by a remote attacker to...

Huawei EulerOS: Security Advisory for grpc (EulerOS-SA-2024-1083)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

The vulnerability of the template mechanism in the SugarCRM system allows a perpetrator to execute arbitrary code.

The vulnerability of the template mechanism in the SugarCRM system is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially crafted PNG file, which contains embedded PHP code...

The vulnerability in the web interface of the software for managing network infrastructure SINEC INS allows a perpetrator to enhance their privileges.

The vulnerability of the software web interface for managing SINEC INS network infrastructure is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to enhance their privileges by intercepting requests sent to the UMC...

The vulnerability of the icmpping function in the universal monitoring system Zabbix allows a intruder to execute arbitrary code.

The vulnerability of the icmpping function in the Zabbix universal monitoring system is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GitLab 12.6 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22256)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their status CVE-2021-22256 Note that Nessus has not tested fo...

CVE-2023-23430

Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions...

Infinispan circular object references causes out of memory errors

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service...

GHSA-488M-W9FP-5MM2 Infinispan circular object references causes out of memory errors

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service...

NewStart CGSL MAIN 6.06 : gnutls Multiple Vulnerabilities (NS-SA-2023-0100)

The remote NewStart CGSL host, running version MAIN 6.06, has gnutls packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with...

The vulnerability of the update loader for the Plantronics Hub application, which allows a hacker to elevate their privileges.

The vulnerability of the application update downloader for controlling audio device settings in Plantronics Hub is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow attackers to increase their privileges...

PT-2023-31920 · Steve Community · Ocpp-Jaxb

Name of the Vulnerable Software and Affected Versions: SteVe Community ocpp-jaxb versions prior to 0.0.8 Description: The issue generates invalid timestamps, such as ones with month 00, in certain situations. This can occur when an application receives a StartTransaction Open Charge Point Protoco...

The vulnerability of the scanning function of SSL/TLS-protocol-based antivirus software from ESET, including ESET NOD32, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Endpoint Antivirus for Linux, ESET Server Security for Windows Server (File Security for Microsoft Windows Server), ESET Mail Security for Microsoft Exchange Server, ESET Mail Security for IBM Domino, ESET Security for Microsoft SharePoint Server, ESET File Security for Microsoft Azure, and ESET Server Security for Linux, allows attackers to bypass the security measures.

The vulnerability of the scanning function of SSL/TLS-protection in ESET NOD32 antivirus software, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Endpoint Antivirus for Linux, ESET Server...

ocpp-jaxb security vulnerability

ocpp-jaxb is the Java mapping for OCPP. A security vulnerability exists in SteVe Community ocpp-jaxb versions prior to 0.0.8 that stems from an invalid timestamp being generated under certain circumstances, leading to SQL exceptions in the application and potentially compromising the integrity of...

The vulnerability of the TLS implementation of the RTU500 Scripting Interface for programming logic controllers from Hitachi Energy allows attackers to gain unauthorized access to protected information and perform spoofing attacks.

The vulnerability of the TLS implementation in the RTU500 Scripting Interface for programming logic controllers from Hitachi Energy relates to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information a...