Windows Ancillary Function Driver WinSock Privilege Escalation

The vulnerability of the Windows Ancillary Function Driver for WinSock operating systems is related to the assignment of a zero pointer. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

Windows Update Service Privilege Escalation

The vulnerability of the Windows Operating System Update Service lies in the improper handling of symbolic links during file access. Exploiting this vulnerability can allow an attacker to elevate their privileges to a system-level level by performing operations such as deleting, moving, or renami...

boafrm formReflashClientTbl Code Execution

The vulnerability of the submit-url function in the /boafrm/formReflashClientTbl file of the HTTP POST Request Handler component of the microprogramming software for TOTOLINK A702R, A3002R, and A3002RU routers is related to the copying of buffers without checking the size of the input data...

SMB Kernel Client Buffer Overflow DoS

The vulnerability of the parseserverinterfaces function in the fs/smb/client/smb2ops.c module, which is part of the SMB client support in Linux operating systems, involves a numerical port escape or cyclic shift vulnerability. Exploiting this vulnerability could allow an attacker to compromise th...

Adobe Commerce B2B Access Control Bypass

The vulnerability of the software platform for developing and managing Adobe Commerce B2B is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions and gain unauthorized access to protected information...

AngularJS Security Security Bypass

The vulnerability of the AngularJS JavaScript framework for developing single-page applications is related to improper checking of unsafe equivalence of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute arbitrary code...

Active Directory Domain Services DoS

The vulnerability of the application programming interface of the Active Directory Domain Services service on the Windows operating system is related to an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Apache Tomcat DefaultServlet Code Execution

The vulnerability of the DefaultServlet server component in the Apache Tomcat application server is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

JTJT2Go Teamcenter Visualization Parasolid Code Execution

The vulnerability of the 3D viewing tool JT, JT2Go, the product lifecycle management system Teamcenter Visualization, and the 3D geometric modeling tool Parasolid relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow attackers to execute arbitrary code using...

SolarWinds Platform XSS

The vulnerability of the software for network monitoring and IT infrastructure management solutions developed by SolarWinds exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...

SIMATICS7-1500 S7-1200 CPU Family URL Redirect

The vulnerability of the web server of the microprogramming software for programmable logic controllers SIMATICS7-1500 and S7-1200 CPUs is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows an attacker to remotely redirect users to arbitrary URL...

XWiki DatabaseSearch Code Execution

The vulnerability of the DatabaseSearch function in the XWiki platform for creating collaborative web applications stems from the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

Core server component Oracle WebLogic Server Full Access

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, is related to errors in processing input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain full access to the vulnerable software by sending...

GitLab XSS

The vulnerability of the Git-based software platform for collaborative code development on GitLab exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks by sending a specially created XML file...

Azure Identity Libraries Privilege Escalation

The vulnerability of the DefaultAzureCredential and ManagedIdentityCredential components in the Azure Identity Libraries and Microsoft Authentication Library authentication libraries is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow attacke...

Dell PowerProtect Data Manager Password Recovery Unauthorized Access

The software of the centralized backup and disaster recovery system Dell PowerProtect Data Manager has a vulnerability due to a flaw in the mechanism for recovering forgotten passwords. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the...

Sentry-Javascript SSRF

The vulnerability of the Sentry-Javascript software development tool for creating web applications is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Tyk SQL Injection

The vulnerability of the Tyk cloud firewall’s application programming interface is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

njs interpreter Heap Buffer Overflow DoS

The vulnerability of the njsfunctionframe function src/njsfunction.h in the njs interpreter of the nginx server is related to reading beyond the memory boundaries. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Apple Music Android Access Control Disclosure

The vulnerability of the Apple Music app for the Android operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to obtain information about the user’s contacts...

Suricata Code Execution

The vulnerability of the Suricata intrusion detection and prevention system is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Parasolid’s 3D geometric modeling Code Execution

The vulnerability of Parasolid’s 3D geometric modeling tool and the Teamcenter Visualization lifecycle management system lies in the ability to read data beyond the buffer limit when analyzing specially created XT files. Exploiting this vulnerability can allow attackers to trigger service failure...

Citrix Workspace App for Linux Access Control

The vulnerability of the Citrix Workspace App for Linux operating system is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to gain access to user sessions...

Apache Pulsar Authentication Bypass

The vulnerability of the cloud-based messaging and streaming communication platform Apache Pulsar is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the configuration of the cloud-based platfo...

Apache Airflow Hive Provider Input Validation

The vulnerability of the Apache Airflow Hive Provider network software exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

EcoStruxure Geo SCADA Expert Log Injection

The vulnerability of SCADA systems such as EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2019, and EcoStruxure Geo SCADA Expert 2021, along with ClearSCADA, is related to improper processing of output data for log files. Exploiting this vulnerability allows a malicious actor to...

MalwareFox AntiMalware drivers Privilege Escalation

The vulnerability of the zam64.sys and zam32.sys drivers in the MalwareFox AntiMalware software is related to deficiencies in access control. Exploiting this vulnerability can allow a hacker to enhance their privileges...

Firefox ESR Access Control Privilege Escalation

The vulnerability of Firefox and Firefox ESR browsers is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to trigger the loading of documents with higher privileges from a remote location...

E2fsprogs debugfs e2fsck DoS

The vulnerability of the debugfs and e2fsck utilities in the E2fsprogs set of utility programs in the EMIAS OS is related to calling functions with incorrectly defined arguments. Exploiting this vulnerability allows an attacker to call functions, procedures, or subprograms with incorrectly...

AMD IBPB Unauthorized Access

The vulnerability of the Indirect Branch Prediction Barrier IBPB implementation in AMD microprocessors is related to improper cleaning of the RAS stack. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a secondary channel...

Kubernetes Cluster Synchronization Resource Cleanup DoS

The vulnerability of the Kubernetes cluster synchronization software, which relies on configuration sources like Flux and the Kubernetes package manager Helm, is related to improper resource cleanup or release. Exploiting this vulnerability allows a malicious actor to cause service failures...

Cisco IOx Path Traversal

The vulnerability of the Cisco IOx software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Microsoft Exchange Server Code Execution

The vulnerability of Microsoft Exchange Server is related to incorrect code generation management. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code...

Cisco Expressway Series Telepresence VCS Root Code Execution

The vulnerability of the Web interface for controlling Cisco Expressway Series and Cisco Telepresence VCS devices is related to insufficient checking of the command arguments entered by users. Exploiting this vulnerability allows a malicious actor to execute arbitrary code as a root user remotely...

Microsoft Defender for IoT Code Execution

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted request...

1C-Bitrix CMS Vote Module Arbitrary File Upload

Vulnerability of the “vote” module in the content management system CMS of 1C-Bitrix: Website management involves the ability to send specially crafted network packets. Exploiting this vulnerability can allow a malicious actor to upload arbitrary files into the vulnerable system...

NETGEAR R6400 software Data Compromise

The vulnerability of NETGEAR R6400 router’s built-in software is related to improper code generation. Exploiting this vulnerability can allow a remote attacker to compromise the integrity and accessibility of the protected information...

KrServerBDdemoRT.exe SCADA DoS

The vulnerability of the KrServerBDdemoRT.exe module of the “KRUG-2000” SCADA system is related to the absence of authentication for a critical function. Exploiting this vulnerability can allow an intruder to cause a service failure remotely...

DBI Programming Language Module DoS

The vulnerability of the DBI programming language module in Perl is related to an unvalidated return value in the hvFetch function when checking for the presence of NULL. Exploiting this vulnerability could allow an attacker to cause a service failure...

LibVNCServer Resource Leak Unauthorized Access

The vulnerability of the cross-platform library LibVNCServer is related to the failure to release resources after the expiration of their useful period. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information...

logback-core Heap Buffer Overflow DoS

The vulnerability of the logback-core class in the QOS.ch file of the Jackson-databind library is related to the recovery of unreliable data in memory. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

Traffic Ops API Authentication Bypass

The vulnerability of the Traffic Ops API component of the Apache Traffic Control system for building CDN networks is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process...

Django format() DoS

The vulnerability of the django.utils.numberformat.format function in the Django web development framework is related to uncontrolled memory consumption, which can lead to a complete exhaustion of resources. Exploiting this vulnerability may allow an attacker to cause a service failure...

Google Chrome Omnibox Replacement

The vulnerability of the Google Chrome browser is related to incorrect data processing. Exploiting this vulnerability allows a malicious actor to replace the content in the Omnibox URL bar using IDN homographs...

GDB Debugger Code Execution

The vulnerability of the GDB debugger’s gdb module relates to the execution of an operation outside the buffer in memory. Exploiting this vulnerability allows a perpetrator to execute arbitrary code or trigger a service failure using a specially created ELF file...

Jenkins Script Security Plugin Code Execution

The vulnerability of Jenkins Script Security plugin is related to incorrect type conversion. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code or gain unauthorized access to confidential information...

Intel System Support Utility Privilege Escalation

The vulnerability of the Intel System Support Utility relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges by using specially crafted requests...

Ansible User SSH Key Disclosure

The vulnerability of the “User” module in the Ansible configuration management system is related to the exposure of data transmitted as parameters to the ssh-keygen utility. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to user-sensitive information through a...

Oracle CRM Technical Foundation Preferences Unauthorized Access

The vulnerability of the Preferences component of the Oracle CRM Technical Foundation system relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...