CVE-2023-29273 ZDI-CAN-20367: Adobe Substance 3D Painter USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Adobe Substance 3D Painter versions 8.3.0 and earlier is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the...

PT-2023-12986 · Western Digital · Western Digital My Cloud Os 5

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud OS 5 versions prior to 5.26.202 Description: A Server-Side Request Forgery SSRF issue was identified, which could allow a rogue server on the local network to modify its URL to point back to the loopback adapter. This...

PT-2023-22414 · Gl.Inet · Gl-Inet Mt3000

Name of the Vulnerable Software and Affected Versions: GL.iNET MT3000 version 4.1.0 Release 2 Description: The issue is related to OS Command Injection, which can be exploited via the /usr/lib/oui-httpd/rpc/logread endpoint. This allows for potential execution of system commands, posing a securit...

Lenovo XClarity Controller 格式化字符串错误漏洞

Lenovo XClarity Controller XCC is a server-embedded management engine from Lenovo China, which is used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller. An attacker exploited the vulnerability to cause a denial of service on...

CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

ForgeRock Access Management Access Control Error Vulnerability

ForgeRock Access Management is a comprehensive, unified solution from ForgeRock USA designed to quickly enable superior experiences tailored to the unique needs of users and employees. An access control error vulnerability exists in ForgeRock Access Management versions 6.5.0 through 7.2.0, which...

AeroCMS Cross-Site Scripting Vulnerability (CNVD-2023-32025)

AeroCMS is a content management system from the American company AeroCMS. AeroCMS version v0.0.1 suffers from a cross-site scripting vulnerability that stems from the commentauthor and commentcontent parameters of /post.php failing to properly validate user input. An attacker can exploit this...

Buffer overflow

Qihoo 360 https://www.360.cn/ Qihoo 360 Safeguard https://www.360.cn/ Qihoo 360 Total Security http://www.360totalsecurity.com/ is affected by: Buffer Overflow. The impact is: execute arbitrary code local. The component is: This is a set of vulnerabilities affecting popular software, "360...

Fortinet FortiNAC Information Disclosure Vulnerability

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is mainly used for network access control and IoT security. Fortinet FortiNAC information leakage vulnerability, the vulnerability stems from the application for sensitive information...

Microsoft Visual Studio Elevation of Privilege Vulnerability (CNVD-2023-101686)

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. A privilege vulnerability exists in Microsoft Visual Studio. An attacker can exploit this...

CVE-2023-26495

An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reuse an object that has been freed. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code...

Supply Chain Attacks and Critical Infrastructure: How CISA Helps Secure a Nation's Crown Jewels

Critical infrastructure attacks are a preferred target for cyber criminals. Here's why and what's being done to protect them. What is Critical Infrastructure and Why is It Attacked? Critical infrastructure is the physical and digital assets, systems and networks that are vital to national securit...

CVE-2022-43939

creationtimestamp| type| source ---|---|--- 2023-04-03 22:24:51+00:00| seen| https://t.me/cibsecurity/61345 2023-04-08 20:04:44+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/8078 2023-05-11 14:42:41+00:00| seen|...

Authentication flaw

Osprey Pump Controller version 1.01 could allow an unauthenticated user to create an account and bypass authentication, thereby gaining unauthorized access to the system. A threat actor could exploit this vulnerability to create a user account without providing valid credentials. A threat actor w...

CVE-2022-3686 SDM600 API permission check

A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive. This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 Build Nr. 1.2.23000.291...

CVE-2023-26356 ZDI-CAN-19506: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Dimension versions 3.4.7 and earlier is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

CVE-2023-22250 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.4-p2 and earlier and 2.4.5-p1 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this...

CVE-2022-48356

The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition...

Adobe ColdFusion Access Control Error Vulnerability (CNVD-2024-25609)

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. An Access Control Error vulnerability exists in Adobe ColdFusion. The vulnerability stems from improper...

Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CNVD-2023-30868)

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft.Microsoft PCL6 Class Printer Driver is a printer driver from Microsoft. Microsoft PCL6 Class Printer Driver is a printer driver software from Microsoft. A remote code execution...