6123 matches found
CVE-2023-32067
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful...
Buhti Ransomware Gang Switches Tactics, Utilizes Leaked LockBit and Babuk Code
The threat actors behind the nascent Buhti ransomware have eschewed their custom payload in favor of leaked LockBit and Babuk ransomware families to strike Windows and Linux systems. "While the group doesn't develop its own ransomware, it does utilize what appears to be one custom-developed tool,...
Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection
POC exploit for Searchor ' import'os'.popen''.rea...
CVE-2023-33617
An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14X000 was found via the /boaform/admin/formPing targetaddr parameter...
CVE-2023-33617
An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14X000 was found via the /boaform/admin/formPing targetaddr parameter...
Parks Fiberlink 操作系统命令注入漏洞
Parks Fiberlink is a high-performance OLT from Parks designed to deliver ultra-broadband services to large numbers of subscribers in a fast and cost-effective manner. A security vulnerability exists in Parks Fiberlink version 210 2.1.14X000, which stems from a problem with the...
Judging Management System SQL Injection Vulnerability (CNVD-2023-48485)
Judging Management System is a judging management system. Judging Management System has a SQL injection vulnerability in version v.1.0. The vulnerability is related to the critid parameter of the editcriteria.php file, and is due to the program not performing strict filter validation of user inpu...
Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...
The vulnerability of the targetcli iSCSI-client’s command interface allows a hacker to gain access to confidential data.
The vulnerability of the targetcli iSCSI client’s command shell is related to the lack of access control over the /etc/target directory, the backup directory, and the backup files. Exploiting this vulnerability allows an attacker to gain access to confidential data...
gssntlmssp: out-of-bounds read when decoding target information
A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. It has an out-of-bounds read when decoding target information. The length of the avpair is not checked properly for two of the elements, which can trigger an out-of-bounds read via the...
gssntlmssp: incorrect free when decoding target information
A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. An incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the cb and sh buffers contain a copy of the data that needs to...
kernel: scsi: target: iscsi: Fix a race condition between login_work and the login thread
A flaw was found in the iSCSI target component in the Linux kernel. An attacker that can send specific data immediately after a login Protocol Data Unit PDU, can trigger a race condition. This condition can lead to a NULL pointer dereference, causing the kernel to crash and resulting in a denial ...
kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9khtcwaitfortarget function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system...
The vulnerability of the Windows iSCSI Target service allows a hacker to gain unauthorized access to protected information.
The vulnerability of the Windows iSCSI Target service for Windows operating systems is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
Denial Of Service (DoS)
screen is vulnerable to Denial of Service DoS. The vulnerability allows local users to send a privileged SIGHUP signal to any PID resulting in a disruption of the target process...
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169 Pseudo Shell Description This Python script...
Authorization
An improper authorization vulnerability exists in Rocket.Chat 6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room...
CVE-2023-24945
Windows iSCSI Target Service Information Disclosure Vulnerability...