Framework Android Privilege Escalation

The vulnerability of the Framework component in the Android operating system relates to the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow an attacker to increase their privileges...

Adobe InDesign Memory Walking Disclosure

The vulnerability of Adobe InDesign’s computer layout automation tool is related to memory-walking attacks. Exploiting this vulnerability can allow attackers to bypass ASLR protection and disclose the protected information...

Teamcenter Visualization Buffer Overflow Code Execution

The vulnerability of the Teamcenter Visualization lifecycle management system and the Siemens Tecnomatix Plant Simulation software environment relates to the execution of operations beyond the buffer in memory when processing WRL files. Exploiting this vulnerability can allow an attacker to execu...

Teamcenter Visualization Buffer Overflow Code Execution

The vulnerability of the Teamcenter Visualization lifecycle management system and the Siemens Tecnomatix Plant Simulation software environment relates to the execution of operations beyond the buffer in memory when processing WRL files. Exploiting this vulnerability could allow an attacker to...

WP Time Capsule Plugin Upload Handler Code Execution

The vulnerability in the UploadHandler.php script of the WP Time Capsule plugin for WordPress content management system is related to the unlimited uploading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted...

ASPECT Enterprise Network Control Information Disclosure

The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow an intruder to gain unauthorized access to resources and...

Nextcloud Server DoS

The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Linux kernel cgroup DoS

The vulnerability of the Linux operating system’s kernel cgroup component is related to the lack of memory release after the effective lifespan of the component has ended. Exploiting this vulnerability can allow an attacker to cause a service failure...

Intel Neural Compressor Privilege Escalation

The vulnerability of the Intel Neural Compressor library for optimizing machine learning models is related to the lack of measures taken to neutralize special elements in the template creation mechanism. Exploiting this vulnerability can allow a remote attacker to enhance their privileges...

Tenda G3 FormSetDebugCfg Code Execution

The vulnerability of the formSetDebugCfg function in the wireless access point software Tenda G3 is related to buffer overflows based on a stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending specially crafted POST requests...

Ivanti Connect Secure Policy Secure Command Injection

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary co...

SIMATIC CP 1543-1 Authorization Bypass

The vulnerability of the microprogramming software for the SIMATIC CP 1543-1 communication modules is related to incorrect authorization. Exploiting this vulnerability can allow an attacker, operating remotely, to circumvent existing security restrictions...

Intel Alias Checking Trusted Module Privilege Escalation

The vulnerability of the Intel Alias Checking Trusted Module Intel ACTM, a microprogramming software component of Intel’s 4th and 5th generation processors, is related to synchronization errors when using common resources. Exploiting this vulnerability can allow attackers to increase their...

FreeBSD Hypervisor Code Execution

The vulnerability of the hypervisor in FreeBSD operating systems relates to a single-shift error. Exploiting this vulnerability allows an attacker to execute arbitrary code...

dwc2 Kernel DoS

The vulnerability of the dwc2 component in the Linux operating system’s kernel is related to improper validation of input data in the dwc2cmplhostisocdmadesc function. Exploiting this vulnerability can allow an attacker to cause a service failure...

Schneider Electric EcoStruxure IT Gateway Authentication Bypass

The vulnerability of Schneider Electric EcoStruxure IT Gateway’s software for communicating with controlled devices is related to the absence of an authentication procedure. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the vulnerable...

Linux kernel DRM/VKMS DoS

The vulnerability of DRM/VKMS components in Linux operating systems is related to improper input validation in the function applyluttochannelvalue. Exploiting this vulnerability can allow an attacker to trigger a service failure...

Relevanssi Plugin XSS

The vulnerability of the Relevanssi plugin of the WordPress content management system exists due to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by injecting malicious scripts...

1C-Bitrix Insufficient Protection Auth Bypass

The vulnerability of the 1C-Bitrix website content management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to gain access to authentication data from the SMTP server...

Intel Trace Analyzer and Collector Search Path Uncontrolled

The vulnerability of the MPI process tracing tools Intel Trace Analyzer and Collector is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

D-Link cgi_set_cover() Arbitrary Command Execution

The vulnerability of the cgisetcover function /cgi-bin/photocentermgr.cgi in the microprogramming software of D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4,...

D-Link DNS-320 Router Web Management Interface Disclosure

The vulnerability of the /cgi-bin/widgetapi.cgi file of the Web Management Interface component of the D-Link DNS-320 router software relates to the disclosure of information. Exploiting this vulnerability could allow an attacker to disclose confidential information by manipulating the...

Fast-Loops Platform Code Execution

The vulnerability of tools for working with arrays and objects in RobinWeser Fast-Loops, as well as in event monitoring, threat detection, and security analytics platforms like IBM QRadar Suite and IBM Cloud Pak for Security, is related to uncontrolled changes in object prototype attributes...

Ingress Nginx Privilege Escalation

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to errors in processing Ingress object annotations. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Cisco Small Business SPA300/SPA500 Web Interface Command Execution

The vulnerability of the web interface of Cisco Small Business SPA300 and SPA500 microprogramming software lies in the copying of input data into memory without checking its size. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands on the basic...

Juniper Networks Junos OS Data Compromise

The vulnerability of the user interface of Juniper Networks Junos OS is related to the incorrect implementation of user interface security functions. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the integrity of the protected information...

MySQL InnoDB DoS

The vulnerability of the InnoDB component in the MySQL Database Management System is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures using the MySQL protocol...

D-Link Router Command Injection

The vulnerability of D-Link DIR-1960-US, DIR-2640-US, DIR-2660-US, DIR-3040-US, DIR-3060-US, DIR-867-US, DIR-878, DIR-882-US, DIR-882/RE, DIR-882-CA, and DIR-882-US/RE routers exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability can allow a malicious...

SolarWinds Access Rights Manager AddReportResult Data Access

The vulnerability of the AddReportResult method in the SolarWinds Access Rights Manager ARM access control software is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...

Update Service WSDL Query Processor File Read

The vulnerability of the WSDL query processor in the “Update Service” software is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain read access to local files...

Grafana OnCall Webhook SSRF

The vulnerability of the webhook component in the Grafana OnCall notification system is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Netcat Code Execution

The vulnerability of the CMS system Netcat is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to set arbitrary values for authentication data to access the 1C data import module and execute arbitrary code...

Local Security Authority Subsystem Service Disclosure

The vulnerability of the Local Security Authority Subsystem Service LSASS in Windows operating systems relates to the use of an uninitialized resource. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by this service...

CRI-O Container Engine Resource Restriction DoS

The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, is related to an experimental exploit that allows containers to become unlimited in size. Exploiting this vulnerability could enable a...

Uniview IP cameras Auth Bypass

The vulnerability of Univew’s web-based IP camera control interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain full access to the device...

NGINX QUIC DoS

The vulnerability of HTTP/3 QUIC in NGINX Plus and NGINX OSS web servers is related to the swapping of the zero pointer. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending specially crafted requests...

aiohttp HTTP Request Hijacking

The vulnerability of the aiohttp HTTP client is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to perform an “HTTP request hijacking” attack...

XWiki Platform User Registration Code Execution

The vulnerability of the user registration function of the XWiki Platform is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Rapid SCADA Full Control

The vulnerability of the SCADA system Rapid SCADA is related to the use of rigidly encoded accounting data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full control over the system...

Rapid SCADA Privilege Escalation

The vulnerability of the SCADA system Rapid SCADA is related to the incorrect assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

Jenkins GitLab Branch Source Plugin Auth Bypass Info Disclosure

The vulnerability of the Jenkins GitLab Branch Source Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...

Juniper Networks J-Web Auth Bypass Info Disclosure

The vulnerability of the J-Web interface in Juniper Networks Junos OS operating systems is related to the lack of authentication for critical functions and deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow a malicious actor to gain access to confidential...

Saia PG5 Controls Suite XML External Object Reference Unauthorized Access

The vulnerability of the programming software for PLCs programmable logic controllers, Saia PG5 Controls Suite, is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Qualcomm Embedded Software Assert Failure

The vulnerability of embedded software developed for Qualcomm chips lies in the improper implementation of the channel bandwidth division mechanism and the switching between subbands when performing Beam Switching. This occurs due to the use of the assert function. Exploiting this vulnerability c...

USB Peripheral Code Execution

The vulnerability of the interface for connecting peripheral devices via USB in Google Chrome browsers is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created web page...

Clario VPN Data Transmission

The vulnerability of the Clario VPN client relates to the lack of protection for transmitted data. Exploiting this vulnerability allows a hacker to send arbitrary IP traffic as plain text beyond the VPN tunnel...

Sangfor NGAF File Code Execution

The vulnerability of the /LogInOut.php file in the Sangfor NGAF firewall lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP POST request remotely...

Supermicro X11 series BMC IPMI XSS

The vulnerability in the web interface of BMC IPMI Supermicro X11 series servers exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted GET requests...

SolarView Compact conf_mail.php Arbitrary Command Execution

The vulnerability of the confmail.php component in the microprogramming software for solar power measurement, data display, and storage in SolarView Compact exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability can...

FortiOS Graphical Interface XSS

The vulnerability of the graphical interface of FortiOS operating systems and the proxy server used for protecting against Internet attacks FortiProxy exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute...