The vulnerability of HashiCorp’s Vault and Vault Enterprise archiving platforms relates to errors in the certificate validation process. This allows attackers to bypass the authentication process.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms relates to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to bypass the authentication process...

CVE-2024-28070

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive...

CVE-2024-25998

An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation...

CVE-2024-26002

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files...

CVE-2024-26001

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

PT-2024-2542 · Lenovo · Lenovo Laptops

Name of the Vulnerable Software and Affected Versions: Lenovo laptops affected versions not specified Description: The issue is related to the implementation of System Management Mode SMM in Lenovo laptop firmware, which is associated with insufficient input validation. This could allow an attack...

Siemens 多款产品缓冲区错误漏洞

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

PT-2024-21274 · Unknown · Mqtt Stack

The MQTT stack is susceptible to an unauthenticated remote attack due to improper input validation, allowing an attacker to write memory out of bounds. The brute force attack is not always successful because of memory randomization. An exploit for this issue may exist, with potential links to the...

CVE-2024-23717

In accesssecureservicefromtempbond of btmsec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2024-0044

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

The vulnerability of the microprogrammed software of iDRAC8 controllers, related to improper verification of consistency in input data, allows a intruder to gain control over the basic operating system.

The vulnerability of the microprogrammed software of iDRAC8 controllers is related to improper verification of consistency in input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain control over the basic operating system...

Google Android 注入漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to incorrect input validation in createSessionInternal of PackageInstallerService.java. An attacker can exploit the vulnerability to escalate privilege...

PT-2024-6136 · Аврора · Аврора

Name of the Vulnerable Software and Affected Versions: Аврора affected versions not specified Description: The issue is related to a component validation vulnerability in the Аврора operating system, which is caused by the lack of control over public write permissions for installed application...

CVE-2024-28222

In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file...

Veritas NetBackup Security Vulnerability

Veritas Technologies Veritas NetBackup is a powerful enterprise-class data backup management software from Veritas Technologies. A security vulnerability exists in Veritas NetBackup versions prior to 8.1.2, and NetBackup versions prior to 3.1.2, which originates from a failure of the BPCD process...

CVE-2024-20346

A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perform a reflected cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of...

tomcat: HTTP request smuggling via malformed trailer headers

An improper Input validation flaw was found in Apache Tomcat due to incorrect parsing of HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests, leading to the possibility of request smuggling when behind a...

The vulnerability of the Visual Analyzer component of the Oracle Business Intelligence Enterprise Edition software allows a malicious individual to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Visual Analyzer component of the Oracle Business Intelligence Enterprise Edition software is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete...

The vulnerability of the WDAC OLE DB driver for SQL Server on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the WDAC OLE DB driver for SQL Server on Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2024-14588 · Unknown · Libsec-Ril

Name of the Vulnerable Software and Affected Versions: libsec-ril versions prior to SMR Sep-2023 Release 1 Description: The issue is related to improper input validation in the IpcTxSndSetLoopbackCtrl function in libsec-ril, allowing local attackers to write out-of-bounds memory. This can be...