vConsole Prototype Contamination

The vulnerability of the setOption function in the vConsole software package is related to unregulated changes to object prototypes’ attributes. Exploiting this vulnerability could allow a malicious actor to execute a “prototype pollution” attack remotely...

MinIO Privilege Escalation

The vulnerability of the MinIO object storage server is related to deficiencies in access control based on the UpdateServiceAccountAdminAction policy. Exploiting this vulnerability allows an attacker operating remotely to enhance their privileges...

Zyxel Ethernet Switches XSS

The vulnerability of the microprogramming software used in Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, and ZyWALL 1100 lies in the lack of protective measures for the website...

PDFium PDF Content Processor DoS

The vulnerability of the PDFium PDF-content processor in Google Chrome browser is related to an error that causes previously freed memory to be reclaimed. Exploiting this vulnerability could allow a remote attacker to cause a service failure through the use of a specially created PDF file...

B&R Automation Runtime TLS SSL Compromise

The vulnerability of the TLS and SSL protocol implementations in B&R Automation Runtime and B&R mapp View software for process control and management involves the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor to compromis...

Grafana Access Control Privilege Escalation

The vulnerability of the Grafana monitoring and observation platform, related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

messaging video conferencing Path Traversal Information Disclosure

The vulnerability of the Message and Video Conference Messaging tool is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Totolink A3002R Form Wsc Code Execution

The vulnerability of the formWsc function in the Totolink A3002R router’s microprogramming software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...

Zabbix universal monitoring system Data Compromise

The vulnerability of the Zabbix universal monitoring system is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and even cause service failures...

Libjpeg-turbo Buffer Overflow DoS

The vulnerability of the Libjpeg-turbo library for image processing is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures due to corrupted JPEG files...

Medtronic MiniMed Authentication Bypass

The vulnerability of Medtronic MiniMed 508, 522, 523, 523K, 551, 722, 723, 723K, and 751 insulin pumps is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows attackers to bypass the authentication process by executing a hijacked request...

Gstreamer Integer Overflow DoS

The vulnerability of the Gstreamer multimedia framework is related to a potential integer overflow. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures through a specially created file...

Oracle Enterprise Communications Broker WebGUI Data Compromise

The vulnerability of the WebGUI component of the Oracle Enterprise Communications Broker relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

ImageMagick WriteMSLImage Heap Buffer Overflow DoS

The vulnerability of the WriteMSLImage function in the coders/msl.c component of the console-based image editing tool ImageMagick is related to improper memory release before deleting the last reference. Exploiting this vulnerability may allow an attacker to cause a service failure...

Network Configuration Manager XSS

The Network Configuration Manager NCM software is associated with the failure to take measures to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to carry out XSS attacks remotely...

Admidio ecard_send.php Code Execution Data Access

The vulnerability in the ecardsend.php script /admprogram/modules/ecards/ecardsend.php of the Admidio membership and access control application relates to the improper elimination of special elements used in SQL queries when processing the ecardrecipients parameter. Exploiting this vulnerability...

Eclipse Jetty Service Data Protection

The vulnerability of Eclipse Jetty servlet containers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

FFmpeg Arbitrary File Read

The vulnerability of the FFmpeg multimedia library lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to perform attacks aimed at replacing the source material or reading arbitrary files using the Concat protocol in the HTTP Live Streaming HLS...

Gitea Code Execution

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code and gain unauthorized access to...

edna Chat Center Customer Request Processing System Information Disclosure

The vulnerability of the edna Chat Center’s customer request processing system is related to the improper handling of exceptional states. Exploiting this vulnerability allows a malicious actor to determine the true identities of users...

httpd daemon Code Execution

The vulnerability of the httpd daemon in the microprogramming-based router software from TP-Link, the TL-WR940N, is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

VMware ESXi VMXNET3 Unauthorized Access

The vulnerability of the virtual network adapter vmxnet3 in VMware ESXi, VMware Workstation, and VMware Fusion lies in the issue of data writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

TrueConf Server Authentication Bypass Privilege Escalation

The vulnerability of the TrueConf Server software is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary scripts and increase their privileges...

.NET Privilege Escalation

The vulnerability of the .NET software platform is related to insufficient validation of output data. Exploiting this vulnerability can allow attackers to enhance their privileges...

Craft CMS Path Traversal SSTI

The vulnerability of the Craft CMS content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perform Server Side Template Injection SSTI attacks...

GPCIDrv and GDrv Drivers Code Execution

The vulnerability of the GPCIDrv and GDrv drivers is related to the open IOCTL mechanism, which lacks sufficient access control. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Windows GDI Unauthorized Access

The vulnerability of the Windows GDI component in Windows operating systems is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Solaris Partial DoS

The vulnerability of the Kernel Cryptography sub-component of the Solaris operating system is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating locally, to gain access to modify, add, or delete data, or cause a partial service failure...

Linux kernel Phantom Plane DoS

The vulnerability of the enablephantomplane function in the drivers/gpu/drm/amd/display/dc/dml2/dml2mallphantom.c kernel of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

sqlparse Heap Buffer Overflow DoS

The vulnerability of the sqlparse.parse function in the SQL parser module for Python, Sqlparse, is related to an uncontrolled recursion during the processing of deeply nested lists. Exploiting this vulnerability could allow a malicious actor to cause service failures...

HDF5 Heap Buffer Overflow DoS

The vulnerability of the H5Odtypedecodehelper function in the H5Odtype.c file is related to the dereferencing of NULL pointers. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...

Microsoft Exchange Server Privilege Escalation

The vulnerability of Microsoft Exchange Server is related to access control errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

libhevc Code Execution

The vulnerability of the libhevc library in the Android operating system’s Media Framework is related to lack of access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

VoIP gateway software Telecom MG Unauthorized Access

The vulnerability of the VoIP gateway software of Telecom MG is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

AccessCtrlTimeSchedRpm Component DoS

The vulnerability of the AccessCtrlTimeSchedRpm component /userRpm/AccessCtrlTimeSchedRpm.htm of the TP-Link routers TL-WR940N, TL-WR841N, TL-WR941N, TL-WR940N, and TL-WR740N is related to the execution of an operation outside the buffer in memory when processing the Changed parameter. Exploiting...

JunOS Routing Protocols Daemon DoS

The vulnerability of the Routing Protocols Daemon RPD service on the JunOS operating system is related to an uncontrolled memory consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Debian GNU/Linux Remote Compromise Protected Information

The multiple vulnerabilities in the linux-headers-2.6.18-6-486 package of the Debian GNU/Linux operating system may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

Linux kernel Bluetooth DoS

The vulnerability in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

NPM vm2 Code Execution

The vulnerability of the NPM package manager’s vm2 library is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Microsoft Configuration Manager Privilege Escalation

The vulnerability of Microsoft Configuration Manager software for managing IT infrastructure is related to access control errors. Exploiting this vulnerability can allow attackers to enhance their privileges...

GPAC multimedia platform Dash Client Heap Buffer Overflow DoS

The vulnerability of the gfdashdownloadinitsegment function in the src/mediatools/dashclient.c file of the GPAC multimedia platform is related to manipulating the baseiniturl argument, which causes a null pointer dereferencing. Exploiting this vulnerability could allow an attacker to cause servic...

NVIDIA Graphics Processor Information Disclosure

The vulnerability of NVIDIA GeForce, Quadro, NVS, and Tesla graphics processors’ microprogramming software relates to the disclosure of system data by unauthorized individuals. Exploiting this vulnerability can allow a hacker to gain unauthorized access to protected information...

DWG File Parser Component Code Execution

The vulnerability of the DWG File Parser component in the CADImage plugin for IrfanView software, which is used for viewing and playing graphic, video, and audio files, relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an...

Websoft HCM Automation Software XSS

The vulnerability of Websoft HCM’s automation software for HR processes is related to insufficient verification of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code by sending a specially crafted POST request...

Adobe InDesign Buffer Overflow RCE

The vulnerability of Adobe InDesign’s computer layout automation tool is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

Linux kernel Memory Management Heap Buffer Overflow DoS

The vulnerability of the dosyscachestat function in the mm/filemap.c module of the Linux kernel’s memory management subsystem is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain access to protected information or cause service failures...

ABB System 800xA DoS

The vulnerability of the distributed control system ABB System 800xA is related to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to trigger maintenance failures by sending numerous messages...

C library Heap Buffer Overflow DoS

The vulnerability of the wcsnrtombs function in the C library for Linux-based operating systems is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

MediaTek MC7603E Wi-Fi Driver Privilege Escalation

The vulnerability of the Wi-Fi driver microprogramming software for MediaTek’s MC7603E, MC7610, MC7612, MC7613, MC7615, MC7620, MC7622, MC7628, MC7629, and MC7915 lies in the reading of data outside of the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain elevate...

Windows Manager extensions Code Execution

The vulnerability of the Windows Manager extensions in Microsoft Edge and Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...