CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...

The vulnerability of Google Chrome browser-based PDF processing components allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Google Chrome browser-based PDF processors relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially crafted HTML page...

CVE-2023-3743 SQL injection vulnerability in LeoTheme's Ap Page Builder

Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the productoneimg parameter to retrieve the information stored in the database...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from the US-based company Mattermost. Mattermost suffers from a security vulnerability that stems from allowing an attacker to crash the server via specially crafted markdown input...

CVE-2023-33857 IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain system information using a specially crafted query that could aid in further attacks against the system. IBM X-Force ID: 257695...

Apache Airflow Security Bypass Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.6.3,...

Buffer overflow

Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller...

Information disclosure

Server information leak of configuration data when an error is generated in response to a specially crafted message...

CVE-2023-25078

Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. See Honeywell Security Notification for recommendations on upgrading and versioning...

CVE-2023-22435

Experion server may experience a DoS due to a stack overflow when handling a specially crafted message...

Stack overflow

Experion server may experience a DoS due to a stack overflow when handling a specially crafted message...

Design/Logic Flaw

Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation...

CVE-2023-29451

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy...

CVE-2023-29451

Specially crafted string can cause a buffer overrun in the JSON parser library leading to a crash of the Zabbix Server or a Zabbix Proxy...

CVE-2023-37565

Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier,...

Honeywell Products 缓冲区错误漏洞

Honeywell Products is a line of products from Honeywell, Inc. A security vulnerability exists in Honeywell Products that stems from the possibility that the Experion server may encounter a DoS due to a stack overflow while processing a specially crafted message...

Microsoft Paint 3D Code Execution (July 2023)

The Windows 'Paint 3D' app installed on the remote host is affected by multiple code execution vulnerabilities. An attacker who successfully exploited one of the vulnerabilities could execute arbitrary code. Exploitation of the vulnerabilities requires that a program process a specially crafted...

Security Bulletin: IBM® Db2® federated server is vulnerable to a denial of service when using a specially crafted wrapper using certain options. (CVE-2023-30442)

Summary IBM® Db2® federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. Vulnerability Details CVEID:CVE-2023-30442 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server federated server is...

Path traversal

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-23 in FortiAnalyzer and FortiManager management interface 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions may allow a remote and authenticated attacker to retrieve arbitrary files from the...

CVE-2023-30448

IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on certain tables. IBM X-Force ID: 253437...