2532 matches found
The software system of Schneider Electric’s industrial automation solutions, Codesys, has vulnerabilities. These vulnerabilities allow attackers to cause a loss of control and trigger malfunctions during maintenance operations.
The vulnerability of the Codesys software suite for industrial automation integrated into Schneider Electric’s programmable logic controllers is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to gain control and caus...
KLA49377 Multiple vulnerabilities in Microsoft Browser
Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, spoof user interface, gain privileges. Below is a complete list of vulnerabilities: 1. Use after free...
CVE-2023-2749 A Gain Information vulnerability was found on Download Center.
Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected...
Dell NetWorker 操作系统命令注入漏洞
Dell NetWorker is an application from Dell USA Inc. It provides forum discussion functionality for Dell Inc. An operating system command injection vulnerability exists in Dell NetWorker version 19.6.1.2. An attacker could exploit this vulnerability to execute arbitrary operating system commands o...
Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals
Void Rabisu, a malicious actor believed to be associated with the RomCom backdoor, was thought to be driven by financial gain because of its ransomware attacks. But in this blog entry, we discuss how the use of the RomCom backdoor in recent attacks shows how Void Rabisu's motives seem to have...
Code injection
Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack...
Cisco Identity Services Engine Path Traversal Vulnerability (cisco-sa-ise-traversal-ZTUgMYhu) (CSCwd07350)
According to its self-reported version, Cisco Identity Services Engine Path Traversal Vulnerabilities is affected by a path traversal vulnerability. A vulnerability in the CLI of Cisco ISE could allow an authenticated, local attacker to perform a path traversal attack to escape the restricted she...
About the security content of iOS 15.7.6 and iPadOS 15.7.6
About the security content of iOS 15.7.6 and iPadOS 15.7.6 This document describes the security content of iOS 15.7.6 and iPadOS 15.7.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...
CVE-2023-29837
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solution EUCS v.1.0 allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page...
VulnCheck KEV: CVE-2014-0196
Linux Kernel contains a race condition vulnerability within the nttywrite function that allows local users to cause a denial-of-service DoS or gain privileges via read and write operations with long strings...
KLA49156 Multiple vulnerabilities in Microsoft Products (ESU)
Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, execute arbitrary code, cause denial of service. Below is a complete list of...
KLA49166 Multiple vulnerabilities in Mozilla Firefox ESR
Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, spoof user interface, execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in Content proce...
RUSTSEC-2023-0066 Vulnerable to privilege escalation using ioctls TIOCSTI and TIOCLINUX
please is vulnerable to privilege escalation using ioctls TIOCSTI and TIOCLINUX on systems where they are not disabled. Here is how to see it in action: $ cd "$mktemp -d" $ git clone --depth 1 https://gitlab.com/edneville/please.git $ cd please/ $ git rev-parse HEAD...
Ego Studio SuperClean 资源管理错误漏洞
Ego Studio SuperClean is a versatile and powerful phone cleaner, reliable optimizer for Android from Ego Studio. A security vulnerability exists in Ego Studio SuperClean version v.1.1.9, v.1.1.5. An attacker exploited the vulnerability to gain privileges via the updateinfo field of the default.xm...
Input validation
A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute...
CVE-2023-28966
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing files or execute commands as root. The issue is caused by improper file and directory permissions on certain system files, allowing an...
Design/Logic Flaw
An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ preset parameters...
Fortinet Releases April 2023 Vulnerability Advisories
Fortinet has released its April 2023 Vulnerability Advisorieslink is external to address vulnerabilities affecting multiple products. An attacker could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Fortinet April...