CVE-2021-44454

Improper input validation in a third-party component for IntelR QuartusR Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2022-21174

Improper access control in a third-party component of IntelR QuartusR Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-37254

CVE-2021-37254 affects M-Files Web prior to 20.10.9524.1 and 20.10.9445.0. A remote attacker could obtain unauthenticated access to license key information for third‑party components stored on the server. Root cause and exact exploitation details are not provided in the documents. No remediation ...

Denial of service in third-party component in Vaadin 7 and 8

Improper check for exceptional condition in a third party HTML handling library used in com.vaadin:vaadin-server versions 7.0.0 through 7.7.27 Vaadin 7.0.0 through 7.7.27 and 8.0.0 through 8.13.3 Vaadin 8.0.0 through Vaadin 8.13.3 allows network attackers to cause denial of service via unspecifie...

Siemens LOGO! CMR and SIMATIC RTU 3000

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: LOGO! CMR2020, LOGO! CMR2040 and SIMATIC RTU 3000 family Vulnerabilities: Incorrect Calculation of Buffer Size, Improper Certificate Validation 2. RISK EVALUATION Successful...

Drupal 9.1.x < 9.1.12 Third-Party Library Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.18, 9.1.x prior to 9.1.12, or 9.2.x prior to 9.2.4. It is, therefore, affected by multiple vulnerabilities due to its usage of a third party component, CKEditor, for WYSIWYG...

Tenable Nessus Agent < 8.2.3 Multiple Vulnerabilities (TNS-2021-04)

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token. Additionally, one third-part...

[R1] Nessus 8.13.1 Fixes Multiple Vulnerabilities

Nessus leverages third-party software to help provide underlying functionality. One third-party component OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to upgrade the bundl...

CVE-2020-10643

An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component...

Design/Logic Flaw

An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component...

CVE-2020-10643

CVE-2020-10643 affects OSIsoft PI Vision (PI System) with a cross-site scripting vulnerability in the PI Vision web application caused by improper input validation in a third-party component. An authenticated remote attacker can use specially crafted URLs to direct a victim using PI Vision 2019 m...

CVE-2020-10643 OSIsoft PI System

An authenticated remote attacker could use specially crafted URLs to send a victim using PI Vision 2019 mobile to a vulnerable web page due to a known issue in a third-party component...

Remote Code Execution Vulnerability in Application Inspector

A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output. An attacker who exploited it could send sections of the report containing code snippets to an external...

Man-in-the-Middle (MitM)

jcommander is vulnerable to man-in-the-middle attacks. The usage of an insecure HTTP channel during build allows an attacker to intercept and modify network traffic and introduce malicious code into the third-party component...

OMRON CX-Supervisor Vulnerable Third-Party Component Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within Teamviewer tha...

HP Touchpoint Analytics Opens PCs to Code Execution Attack

A security flaw, discovered in an open-source software program that is a key component of HP’s TouchPoint Analytics service, is opening up a wide swath of HP computers to attack. The vulnerability, if exploited by local attackers with administrative privileges, can allow them to execute arbitrary...

TYPO3 9.4.x <= 9.5.7 Insecure Deserialization Vulnerability in Third Party Component

It has been discovered that a third party dependency used by TYPO3 is susceptible of being used during insecure deserialization. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Discourse < 2.3.0.beta11 Third Party Component Vulnerability

Discourse is prone to a prototype pollution vulnerability in the third party component SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Siemens SCALANCE and SIMATIC libcurl (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SCALANCE and SIMATIC Vulnerability: Out-of-bounds Read 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-21-068-10 Siemens SCALANCE and...

Cross-Site Scripting in Flash component (ELTS)

It has been discovered, that the third party component websvg is vulnerable to cross-site scripting. A browser with Flash plugin installed is needed in order to exploit this vulnerability...