Memory corruption

Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from shared MSG RAM in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrag...

CVE-2021-3149

CVE-2021-3149 affects Netshield NANO 25 devices running 10.2.18. The issue is an OS command injection via /usr/local/webmin/System/manual_ping.cgi after authentication, caused by unsafe use of a C library function. Public documents in the set confirm affected product, vulnerable component/file, a...

Design/Logic Flaw

IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 174850...

Shijiazhuang Jiuwing Network Technology Co., Ltd. website system SQL injection vulnerability

Shijiazhuang Jiuwin Network Technology Co., Ltd. to website construction, mobile Internet products, 720-degree panoramic display, VI visual design as the core business and so on. Shijiazhuang Jiuwing Network Technology Co., Ltd. website construction system SQL injection vulnerability, attackers c...

Honeywell OPC UA Tunneller

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Matrikon, a subsidiary of Honeywell Equipment: OPC UA Tunneller Vulnerabilities: Heap-based Buffer Overflow, Out-of-bounds Read, Improper Check for Unusual or Exceptional Conditions, Uncontrolled...

Reolink P2P Cameras

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Reolink Equipment: P2P protocol Vulnerabilities: Use of Hard-coded Cryptographic Key, Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of these...

CVE-2020-4928

IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705...

CVE-2020-4908

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system...

EUVD-2020-9080

Microsoft Excel Remote Code Execution Vulnerability...

CVE-2020-29576

The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password...

[SECURITY] Fedora 33 Update: pam-1.4.0-9.fc33

PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication...

CVE-2020-26548

Aviatrix Controller (pre-R5.4.1290) contains an insecure sudo rule that allows a user to execute any command as any user on the system. This vulnerability affects Controller versions before R5.4.1290 and is supported by multiple sources (e.g., CNVD-2021-17716; NVD CVE-2020-26548) with high impact...

icsmaster

This repository is an offensive tool for ICS Industrial Control Systems security research. It contains a collection of resources, including papers, exploits, firmware, Nmap scripts, and tools, related to ICS security. The repository is organized into several sections, including a directory of...

SUSE-SU-2020:3256-1 Security update for u-boot

This update for u-boot fixes the following issues: Fix CVE-2019-13106 bsc1144656, CVE-2019-13104 bsc1144675, CVE-2019-14192 bsc1143777, CVE-2019-14193 bsc1143817, CVE-2019-14199 bsc1143824, CVE-2019-14197 bsc1143821, CVE-2019-14200 bsc1143825, CVE-2019-14201 bsc1143827, CVE-2019-14202 bsc1143828,...

Important: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

scap-security-guide bug fix and enhancement update

The scap-security-guide project provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol SCAP format and constitutes a catalog of practical hardening advice, linked to government...

CVE-2020-28045

CVE-2020-28045 affects ProlinOS up to 2.4.161.8859R. Root cause: shared libraries are not required to be signed and are not verified, allowing an attacker with local access to load a crafted shared object via LD_PRELOAD, bypassing kernel ELF verification and executing unsigned code. This creates ...

CVE-2019-8832

CVE-2019-8832 is a memory corruption vulnerability in Apple platforms. The issue could allow an application to execute arbitrary code with system privileges. It affects multiple Apple operating systems, with fixes in iOS 13.3, iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 20...

The vulnerability of the OLYMPOX educational control system’s web application, which arises from the failure to protect the structure of the web page, allows a hacker to inject arbitrary code.

The vulnerability of the OLYMPOX educational control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

Fieldcomm Group HART-IP and hipserver

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Fieldcomm Group Equipment: HARP-IP Developer kit, hipserver Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device being...