92710 matches found
The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to deficiencies in pathname restrictions for directories, allows attackers to gain unauthorized access to protected information.
The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to shortcomings in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...
Vulnerability of the CMS system: 1C-Bitrix. Website management that arises from the lack of measures to protect the structure of web pages allows attackers to inject malicious content into the website.
Vulnerability of the CMS system 1C-Bitrix: Website management exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject malicious content using BBcode functions...
The vulnerability in the Splunk Web interface of the Splunk Enterprise operating system’s operational analysis platform allows a perpetrator to execute arbitrary code and gain increased privileges.
The vulnerability in the Splunk Web interface of the Splunk Enterprise operating system’s operational analysis platform is related to an incorrect initialization of resources when processing the OPENSSLDIR value. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain...
The vulnerability of the Apache Airflow network software, the CNCF Kubernetes Provider, allows a hacker to execute arbitrary code.
The vulnerability of the Apache Airflow network software component, specifically the CNCF Kubernetes Provider, is related to deficiencies in the process of eliminating special elements from output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of Bluetooth microprogramming chipset Unisoc, related to the lack of permission checking, allows a intruder to gain unauthorized access to protected information.
The vulnerability of Bluetooth microprogrammed chipset devices from Unisoc lies in the lack of permission checking. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...
The vulnerability of operating systems for managing cloud applications, such as Sealos, stems from deficiencies in authentication procedures. This allows attackers to escalate their privileges and gain full control over the application.
The vulnerability of operating systems for managing cloud applications related to Sealos stems from deficiencies in authentication procedures due to the use of Role-Based Access Control RBAC policies. Exploiting this vulnerability allows a malicious actor to enhance their privileges and gain full...
The vulnerability of the SetAccessPointMode.php script in D-Link router microprogramming devices such as DIR-822 Rev.B, DIR-822 Rev.C, DIR-860L Rev.B, DIR-868L Rev.B, DIR-880L Rev.A, and DIR-890L Rev.A allows a hacker to execute arbitrary commands.
The vulnerability of the SetAccessPointMode.php script in D-Link router microprogramming software such as DIR-822 Rev.B, DIR-822 Rev.C, DIR-860L Rev.B, DIR-868L Rev.B, DIR-880L Rev.A, and DIR-890L Rev.A exists due to the failure to take measures to neutralize the special elements used in the...
The vulnerability of the Windows operating system’s lock screen allows a hacker to bypass security restrictions.
The vulnerability of the Windows operating system’s lock screen is related to security configuration errors. Exploiting this vulnerability can allow a hacker to bypass security restrictions...
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business models RV016, RV042, RV042G, RV082, RV320, and RV325 allows attackers to execute cross-site scripting (XSS) attacks.
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform...
The vulnerability of the blacklistAction() function on the PHP software platform pimcore allows violators to perform cross-site scripting attacks.
The vulnerability of the blacklistAction function in the PHP programming platform pimcore relates to the lack of measures taken to protect the structure of web pages when processing email addresses. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
The vulnerability of the RDMA hardware emulation device by QEMU allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.
The vulnerability of the RDMA hardware emulation device implemented by QEMU is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service failures...
The vulnerability of Eltex “ESR-200” network interface microprogramming software, related to uncontrolled resource consumption, allows a intruder to cause a service failure.
The vulnerability of the microprogrammed service router “ESR-20” is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a hacker to cause a service failure...
The vulnerability in the web interface for managing FatPipe’s software allows a hacker to execute arbitrary code.
The vulnerability of the FatPipe software management web interface is related to the unlimited download of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created malware file...
The vulnerability of the automated Bitcoin payment processing system, BTCPay Server, related to the use of open redirection, allows attackers to carry out phishing attacks.
The vulnerability of the automated Bitcoin payment processing system, BTCPay Server, is related to the use of open redirection when processing the parameter returnUrl=. Exploiting this vulnerability allows a remote attacker to carry out phishing attacks using a specially created malicious link...
The vulnerability of the devredir_proc_client_devlist_announce_req() function on the XRDP server allows a hacker to execute arbitrary code.
The vulnerability of the devredirprocclientdevlistannouncereq function on the XRDP server is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the xrdp_mm_process_rail_update_window_text() function on the XRDP server allows a hacker to execute arbitrary code.
The vulnerability of the xrdpmmprocessrailupdatewindowtext function on the XRDP server is related to integer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of Websoft HCM’s automation software for HR processes lies in its uncontrolled resource consumption, which allows attackers to trigger service interruptions.
The vulnerability of Websoft HCM’s automation software for HR processes is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
The vulnerability of Microsoft Office packages, Microsoft 365 Apps for Enterprise, Microsoft SharePoint, Microsoft Excel, and Microsoft Office Web Apps Server, which stems from the lack of data protection measures, allows attackers to gain unauthorized access to devices.
The vulnerabilities of Microsoft Office packages, Microsoft 365 Apps for Enterprise, Microsoft SharePoint, Microsoft Excel, and Microsoft Office Web Apps Server are related to the lack of protection for sensitive data. Exploiting these vulnerabilities can allow attackers to gain unauthorized acce...
The vulnerability of the SetSysLogSettings() function in the web interface for managing D-Link DIR-1935 router microprogramming software allows a hacker to execute arbitrary code.
The vulnerability of the SetSysLogSettings function in the web interface for managing D-Link DIR-1935 router microprogramming software is related to the failure to sanitize the input data in the string entered by the user when processing the IPAddress element. Exploiting this vulnerability allows...
The vulnerability of the microprogrammed software of the Moxa NE-4100T serial interface converter lies in the lack of authentication procedures, which allows attackers to circumvent existing security restrictions.
The vulnerability of the Microprogrammed Software for Serial Interface Converters Moxa NE-4100T is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...
The vulnerability of the Build Handler component of the Jenkins Git plugin allows a perpetrator to perform arbitrary actions on a vulnerable device.
The vulnerability of the Build Handler component in the Jenkins Git plugin is related to insufficient validation of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on the vulnerable device by manipulating the requests made...
The vulnerability of the kernel of microprogramming software in Qualcomm’s embedded chips allows a hacker to trigger a service failure or execute arbitrary code.
The vulnerability of microprogramming software in embedded Qualcomm chips is related to synchronization errors when using common resources. Exploiting this vulnerability can allow attackers to cause service failures or execute arbitrary code...
The vulnerability of the telnet server’s microprogramming software for the CentreCOM AR260S V2 allows a hacker to gain access to user credentials.
The vulnerability of the telnet server software for CentreCOM AR260S V2 lies in the use of strictly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to gain access to these login credentials remotely...
The vulnerability of the lib9p library in FreeBSD operating systems allows a hacker to execute arbitrary code.
The vulnerability of the lib9p library in FreeBSD operating systems is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the httpd module in DD-WRT microprogramming software allows a hacker to execute arbitrary code.
The vulnerability of the httpd module in DD-WRT microprogramming software is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted HTTP request...
The vulnerability of the loader for microprogramming software SEPCOS Single Package relay controllers and Secheron SEPCOS systems allows a hacker to load arbitrary files.
The vulnerability of the file loading handler in the microprogramming software SEPCOS Single Package Relays and Security Devices Secheron SEPCOS is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a malicious actor to load any...
The vulnerability of the AuthToken component in the microprogramming software for Desigo DXR2, PXC3, PXC4, and PXC5 modules allows a hacker to gain access to the device by intercepting the authentication token.
The vulnerability of the AuthToken component in the microprogramming software for Desigo DXR2, PXC3, PXC4, and PXC5 modules is related to an incorrect expiration time of the session. Exploiting this vulnerability can allow attackers to gain access to the device by intercepting the authentication...
Microsoft Edge browser’s vulnerability, related to insecure management of privileges, allows attackers to elevate their privileges.
The vulnerability of Microsoft Edge relates to the insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
The vulnerability affects implementations of protocols that transmit data to Microsoft applications, Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird. This allows a perpetrator to execute arbitrary code.
The vulnerability in the implementation of protocols that transmit data to Microsoft applications, Mozilla Firefox, Mozilla Firefox ESR, and the email client Thunderbird is related to authentication errors in the handler for the customizable URL scheme. Exploiting this vulnerability allows a remo...
The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows lies in the improper validation of the host name during the server switching process. This allows attackers to execute a “man-in-the-middle” attack.
The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows stems from an improper check of the host name during the request to switch servers. Exploiting this vulnerability allows a remote attacker to...
The vulnerability of the SecUsers.ini file of the controller display utility for OpenBSI allows a hacker to gain unauthorized access to protected information.
The vulnerability of the SecUsers.ini file of the controller display utility related to OpenBSI involves storing confidential information in an unencrypted form in memory. Exploiting this vulnerability could allow a remote attacker to gain access to the user credentials...
The vulnerability of the FTP server Titan FTP Server NextGen, related to the use of pre-installed credentials for the sa account, allows attackers to increase their privileges.
The vulnerability of the Titan FTP Server NextGen installer lies in the use of pre-installed credentials for the sa account. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...
The vulnerability of the networkd-dispatcher component, which manages connection states in Linux operating systems, and is part of the Systemd subsystem responsible for service initialization and management, allows a malicious actor to escalate their privileges or execute arbitrary code.
The vulnerability of the networkd-dispatcher component, which manages connection states and initializes services within Systemd on Linux operating systems, exists due to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow an attacker to...
The vulnerability of the `ziparchive::extractto` function in the PHP programming language lies in its lack of name-based path limitation, allowing attackers to create arbitrary directories.
The vulnerability of the ziparchive::extractto function in the PHP programming language is related to deficiencies in pathname restrictions for directories. Exploiting this vulnerability could allow an attacker to create arbitrary directories remotely...
The vulnerability of the update module for microprogramming software of Cisco Small Business routers such as RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P arises from improper verification of the certificate authenticity. This allows a malicious actor to load arbitrary software images.
The vulnerability of the update module for microprogramming software of Cisco Small Business routers such as RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P is related to improper verification of the certificate authenticity. Exploiting this vulnerability allows a malicious...
The vulnerability of the Display Key Combination Switches in the Wayland server display protocol implementation allows a hacker to compromise data integrity or cause service failures.
The vulnerability of the Display Key Combination Demon in the Wayland display protocol implementation relates to the ability to save the PID of a process in the /tmp/swhks.pid file and incorporate the PID of an existing process into it. Exploiting this vulnerability allows a remote attacker to...
The vulnerability of the VMware Verify component in the Workspace ONE Access application management platform allows a perpetrator to increase their privileges.
The vulnerability of the VMware Verify component in the Workspace ONE Access application management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...
The vulnerability of the AVI_ExtractSubtitle component of the VLC Media Player allows a hacker to gain access to confidential data and also trigger a service failure.
The vulnerability of the AVIExtractSubtitle component in the VLC Media Player media player is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and also cause a service failure by using a...
The vulnerability of the Adobe XMP-Toolkit-SDK software, related to reading beyond the buffer in memory, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Adobe XMP-Toolkit-SDK lies in the creation of temporary files with insecure permissions. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the software used for designing and configuring the Connected Components Workbench (CCW) from Rockwell Automation arises from incorrect restrictions on the path to the restricted access catalog. This vulnerability allows attackers to escalate their privileges.
The vulnerability of the software used for designing and configuring the Connected Components Workbench CCW from Rockwell Automation is related to an incorrect limitation on the path to the restricted-access catalog. Exploiting this vulnerability could allow a attacker to increase their privilege...
The vulnerability of the stb_image.h component in the SIXEL Libsixel encoder/decoder implementation allows a malicious actor to cause a service failure.
The vulnerability of the stbimage.h component in the SIXEL Libsixel encoder/decoder implementation is related to reading data from buffers beyond their acceptable limits. Exploiting this vulnerability allows a malicious actor to cause service failures using a specially created PSD file...
The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in its ability to send XML messages, allowing a hacker to gain full control over the operating system.
The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications is related to the use of strictly encrypted login credentials during the installation of UltraVNC. Exploiting this vulnerability can allow a malicious actor to gain full control over the operating...
The vulnerability of the Windows BackupKey protocol implementation on Windows operating systems allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Windows BackupKey protocol implementation in Windows operating systems is related to the exposure of sensitive information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of IDEMIA’s biometric identification systems’ microprogramming software lies in the lack of authentication mechanisms, which allows attackers to bypass the authentication process.
The vulnerability of IDEMIA’s biometric identification systems’ microprogramming software is related to the absence of authentication. Exploiting this vulnerability could allow a malicious actor to bypass authentication and cause service failures...
The vulnerability of Cisco Small Business 220 Series Smart Switch microprogramming software lies in the lack of protection for service data. This allows a hacker to gain access to confidential login credentials or alter user passwords within the user account.
The vulnerability of the microprogrammed software of Cisco Small Business 220 Series Smart Switches lies in the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain access to login credentials or reconfigure passwords in the user account...
The vulnerability of OPPO’s 5G router, which stems from the failure to take measures to neutralize special elements, allows a perpetrator to execute arbitrary codes.
The vulnerability of OPPO’s 5G router exists due to the failure to take measures to neutralize certain components. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability in SSH authentication within the Cisco Policy Suite, related to the strict encoding of cryptographic keys, allows attackers to elevate their privileges in the system to the root level.
The SSH authentication vulnerability in the Cisco Policy Suite is related to the strict encoding of cryptographic keys. Exploiting this vulnerability allows a malicious actor to elevate their privileges in the system to the root level...
The vulnerability of the Google Chrome web browser’s Extensions relates to the use of memory after it is released. This allows a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of Google Chrome’s browser Extensions relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a specially created HTML page...
The vulnerability of the iOS operating system, caused by overflow in the dynamic memory buffer, allows a hacker to execute arbitrary code with root privileges.
The vulnerability of the iOS operating system arises from an overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...
The vulnerability of the Indexed DB API for browser storage interfaces in Google Chrome and Microsoft Edge allows a attacker to trigger a service failure or execute arbitrary code.
The vulnerability of the Indexed DB API for browser-based structured data storage in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code through a specially...