379 matches found
Apache Arrow R package: Arbitrary code execution when loading a malicious data file
...
CVE-2021-1466
A vulnerability in the vDaemon service of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to cause a buffer overflow on an affected system, resulting in a denial of service DoS condition. The vulnerability is due to incomplete bounds checks for data that is provided to...
CVE-2024-47486
There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...
CVE-2024-47486
There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...
CVE-2024-47486
There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data...
CVE-2024-47486
CVE-2024-47486 affects Hikvision HikCentral Master Lite with an XSS vulnerability that enables an attacker to inject scripts into certain pages by submitting malicious data. The initial description notes XSS in some HikCentral Master Lite versions; connected sources corroborate the issue but do n...
PT-2024-33485 · Acon · Acon
Name of the Vulnerable Software and Affected Versions: ACON affected versions not specified Description: A potential issue has been identified in the input validation process of the ACON library, which could lead to arbitrary code execution if exploited. This could allow an attacker to submit...
Hikvision HikCentral Master Lite 安全漏洞
Hikvision HikCentral Master Lite is an AI Cloud-based application management intelligence platform for edge domains from Hikvision, China. A security vulnerability exists in Hikvision HikCentral Master Lite, which stems from a cross-site scripting XSS vulnerability that allows an attacker to inje...
Deserialization
org.apache.lucene,lucene-replicator is vulnerable to Deserialization. The vulnerability is due to improper validation of serialized input in the org.apache.lucene.replicator.http package, allows attackers to exploit the deserialization process by sending malicious data...
ion-java: ion-java: Ion Java StackOverflow vulnerability
A vulnerability was found in Amazon Ion, an implementation of Ion data notation. Ion-java may be affected by denial of service DoS due to issues while deserializing encoded data into IonValue. A maliciously crafted Ion data structure may be processed and cause a StackOverflowError, leaving the...
Cisco Catalyst SD-WAN Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based...
Galaxy 跨站脚本漏洞
Galaxy is an open source platform for FAIR data analysis open-sourced by the Galaxy Project. A cross-site scripting vulnerability exists in Galaxy versions prior to 24.1.1, which stems from an attacker being able to trick a user into executing arbitrary javascript code when the user is visually...
Security Updates for Microsoft SQL Server OLE DB Driver (July 2024)
The Microsoft SQL Server OLE DB Driver installed on the remote host is missing a security update. It is, therefore, affected by a remote code execution vulnerability. An attacker could exploit the vulnerability by tricking an authenticated user UI:R into attempting to connect to a malicious SQL...
Dahua Security Cameras Exposure of Sensitive Information to an Unauthorized Actor (CVE-2019-9680)
Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious data packets. Affected products include: IPC- HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-...
Dahua Security Cameras Improper Authentication (CVE-2021-33045)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for...
VulnCheck KEV: CVE-2019-15637
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop...
BIT-AIRFLOW-2024-32077 Apache Airflow: XSS vulnerability in Task Instance Log/Log Details
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue...
CVE-2024-31410
The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data...
CVE-2024-31410 CyberPower PowerPanel business Use of Hard-coded Cryptographic Key
The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data...
CVE-2024-31410 CyberPower PowerPanel business Use of Hard-coded Cryptographic Key
The devices which CyberPower PowerPanel manages use identical certificates based on a hard-coded cryptographic key. This can allow an attacker to impersonate any client in the system and send malicious data...