95971 matches found
The vulnerability of the “phase” parameter in the netshop CMS system’s Netcat module allows a hacker to execute arbitrary JavaScript code.
The vulnerability of the “phase” parameter in the netshop CMS system’s Netcat framework exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute any arbitrary JavaScript code in the user’s browser remotely...
The vulnerability of the Daemon Routing Protocols (RPD) in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a attacker to cause service interruptions.
The vulnerability of the Daemon Routing Protocols RPD in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow a malicious actor to cause service failures...
The vulnerability of the statistics module (/admin/index/statistics) in the Admin Classic Bundle administrative interface of the PHP pimcore software platform allows a malicious individual to gain unauthorized access to protected information.
The vulnerability of the statistics module /admin/index/statistics in the Admin Classic Bundle administrative interface of the PHP pimcore software platform is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gai...
The vulnerability of the GL Accounts component of the Oracle Trade Management software, a part of the Oracle E-Business Suite, allows an attacker to gain unauthorized access to read, modify, or delete data.
The vulnerability of the GL Accounts component of the Oracle Trade Management software, a part of the Oracle E-Business Suite, relates to improper authorization. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read, modify, or delete data...
The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos OS Evolved operating system allows a hacker to trigger a service failure.
The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS Evolved operating system is related to insufficient checking of exceptional states. Exploiting this vulnerability can allow a malicious actor to trigger service failures remotely...
The vulnerability of the Work Definition component in the Oracle Enterprise Asset Management application for enterprise asset management systems within the Oracle E-Business Suite allows a malicious actor to gain unauthorized access to read, modify, or delete data.
The vulnerability of the Work Definition component in the Oracle Enterprise Asset Management application for enterprise asset management is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to rea...
The vulnerability of the Fake Authentication Result Handler component in the DKIM-filtering software OpenDKIM allows a perpetrator to influence the integrity of the protected information.
The vulnerability of the Fake Authentication Result Handler component in the DKIM-filtering software OpenDKIM is related to the lack of checks for sequence numbers during the deletion of fake fields. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protecte...
The vulnerability of the IOCTL Handler components in the zam64.sys and zamguard64.sys drivers of the Zemana AntiLogger software allows a hacker to induce a service failure.
The vulnerability of the IOCTL Handler component of the zam64.sys and zamguard64.sys drivers in the Zemana AntiLogger software is related to improper checking of ownership of critical resources. Exploiting this vulnerability allows an attacker to cause a service failure by executing the IOCTL...
The vulnerability of the ruby-find-library-file function in the EMACS text editor arises from improper elimination of special elements used in the command, allowing an attacker to execute arbitrary code.
The vulnerability of the ruby-find-library-file function in the EMACS text editor is related to improper elimination of special elements. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
The vulnerability of the File Protocol Handler component in Cisco Webex Teams software allows attackers to disclose protected information.
The vulnerability of the File Protocol Handler component in Cisco Webex Meetings and Teams software lies in the lack of protection for sensitive data. Exploiting this vulnerability allows a malicious actor to disclose confidential information through a specially crafted link...
The vulnerability of the RubyGems.org repository, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the RubyGems.org repository for programming languages involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...
The vulnerability of the Connect method of the SolarWinds Access Rights Manager software allows a perpetrator to execute arbitrary code.
The vulnerability of the Connect method in the SolarWinds Access Rights Manager software lies in improper restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers allows a perpetrator to execute arbitrary code on the target system.
The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers relates to access to resources through incompatible types. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system using a specially created HTML page...
The vulnerability of the jpc_streamlistremove function (src/libjasper/jpc/jpc_dec.c:2407) in the JPC library, allowing a hacker to trigger a service failure.
The vulnerability of the jpcstreamlistremove function src/libjasper/jpc/jpcdec.c:2407 in the JPC library is related to improper cleaning or release of resources. Exploiting this vulnerability could allow an attacker to cause service failures by using specially created image files...
The vulnerability of the /API/info component of the Linksys E5600 router’s microprogramming software allows a hacker to inject arbitrary commands.
The vulnerability of the /API/info component of the Linksys E5600 router’s microprogramming system lies in the lack of measures taken to neutralize special elements used in the OS commands. Exploiting this vulnerability allows a malicious actor to inject arbitrary commands using the PinCode...
The vulnerability of the Windows Telephony Server server allows attackers to increase their privileges.
The vulnerability of the Windows Telephony Server server for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
The vulnerability of the WDAC OLE DB driver for SQL Server on Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the WDAC OLE DB driver for SQL Server on Windows operating systems is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
The vulnerability of the Easergy Studio software for configuring, monitoring, and controlling industrial equipment lies in the absence of quotation marks when writing elements or search paths. This allows a malicious individual to exploit their privileges.
The vulnerability of the Easergy Studio software for configuring, monitoring, and controlling industrial equipment is related to the absence of quotation marks in the wording of elements or search paths. Exploiting this vulnerability can allow attackers to increase their privileges...
The vulnerability of the cross-platform BitTorrent client qBittorrent, which stems from the use of rigidly programmed credentials, allows a hacker to execute arbitrary commands.
The vulnerability of the cross-platform BitTorrent client qBittorrent relates to the use of default credentials when the user’s web interface is enabled. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability of the nghttp2 codec in the Envoy proxy server allows a attacker to cause a service failure.
The vulnerability of the nghttp2 codec in the Envoy proxy server relates to the implementation of the HTTP/2 protocol. It involves sending an unlimited number of CONTINUATION requests when the maximum header size limit is exceeded, due to the absence of the ENDHEADERS flag. Exploiting this...
The vulnerability of the CGI script nas_sharing.cgi of the D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L NAS devices allows a hacker to execute arbitrary code.
The vulnerability of the CGI script nassharing.cgi of the D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L devices lies in the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code ...
The vulnerability of the oghttp-codec in the Envoy proxy server allows a hacker to trigger a service failure.
The vulnerability of the oghttp-codec in the implementation of the HTTP/2 protocol in the Envoy proxy is related to an error during request submission when exceeding the header size limit. This occurs due to the absence of the ENDHEADERS flag during the processing of CONTINUATION messages...
The vulnerability in the web interface for controlling the Flowmon operating system of network monitoring devices allows a perpetrator to execute arbitrary commands.
The vulnerability of the web interface for controlling the Flowmon operating system in devices for network monitoring exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute...
The vulnerability of the Downloads component of the Google Chrome web browser allows a hacker to replace the user interface.
The vulnerability of the Downloads component in the Google Chrome web browser is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to replace the user interface through a specially created URL address...
The vulnerability of the WP Crontrol plugin of the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the WP Crontrol plugin of the WordPress content management system is related to the loading of code without checking its integrity. Exploiting this vulnerability can allow a hacker to execute arbitrary code...
The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices stems from the lack of measures to neutralize special elements, allowing attackers to execute arbitrary commands.
The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
The vulnerability of the microprogramming software of the Dell PowerProtect Data Manager DM5500, caused by buffer overflow in the queue, allows an attacker to trigger an emergency shutdown of the application or execute arbitrary code.
The vulnerability of the microprogramming software of the Dell PowerProtect Data Manager DM5500 backup device is caused by buffer overflow in the queue. Exploiting this vulnerability can allow an attacker, operating remotely, to cause the application to crash or execute arbitrary code...
The vulnerability in the Apache Kafka cluster management web interface, kafka-ui, allows a attacker to execute arbitrary code.
The vulnerability in the Apache Kafka cluster management web interface, named “kafka-ui”, is related to incorrect code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by using a specially crafted request to the endpoint...
The vulnerability of the log_entry_attr function in the 389-ds-base component of the Red Hat Enterprise Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the logentryattr function in the 389-ds-base component of the Red Hat Enterprise Linux operating system is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the packet-filtering filter in TC Flower software for multi-level switches like Open vSwitch (OvS) allows a hacker to cause a service failure.
The vulnerability of the packet-based flow control filter in TC Flower software multi-level switches like Open vSwitch OvS is related to deficiencies in handling exceptional states due to incorrect processing of packet metadata by Geneve. Exploiting this vulnerability can allow an attacker to cau...
The vulnerability of the Cargo.toml file in the git-based software platform, which facilitates collaborative code development on GitLab, allows a hacker to trigger a service failure.
The vulnerability of the Cargo.toml file in the git-based software development platform for collaborative code management on GitLab is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker, operating remotely, t...
The vulnerabilities of Mitsubishi Electric’s software products, including EZSocket, FR Configurator2, GT Designer3 Version1(GOT1000), GT Designer3 Version1(GOT2000), GX Works2, GX Works3, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA (software included with MC Works64), are related to the absence of authentication for critical functions. This allows attackers to gain unauthorized access to confidential information.
The vulnerabilities of Mitsubishi Electric’s software products, including EZSocket, FR Configurator2, GT Designer3 Version1GOT1000, GT Designer3 Version1GOT2000, GX Works2, GX Works3, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA software included with MC Works64, are relate...
The vulnerability of CoreMedia’s component in the macOS operating system allows a intruder to gain unauthorized access to the camera.
The vulnerability of CoreMedia’s macOS component is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the camera...
The vulnerability of the Software Update component in the macOS operating system allows a hacker to elevate their privileges to root level.
The vulnerability of the Software Update component in the macOS operating system arises from the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...
The vulnerability in the implementation of the ICMPv6 protocol in the Linux operating system’s kernel, through the function fib6_add(), allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability in the implementation of the ICMPv6 protocol in the Linux operating system is related to the reutilization of previously freed memory due to competitive access to resources in the fib6add function within the net/ipv6/ip6fib.c module. Exploiting this vulnerability could allow a...
The vulnerability of the Rapid SCADA system, related to deficiencies in the error reporting mechanism, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the SCADA system Rapid SCADA is related to deficiencies in the mechanism for generating error reports. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information by sending specially crafted requests...
The vulnerability of the Rapid SCADA system, related to the storage of passwords in an unencrypted form, allows a intruder to gain unauthorized access to protected information.
The vulnerability of the SCADA system Rapid SCADA is related to the storage of passwords in an unencrypted form. Exploiting this vulnerability can allow a intruder to gain unauthorized access to protected information...
The vulnerability of the `formAddSysLogRule` function in the wireless access point software Tenda W9 allows a hacker to execute arbitrary code.
The vulnerability of the formAddSysLogRule function in the wireless access point software Tenda W9 involves reading data beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
The vulnerability of the Rapid SCADA system, related to the use of open redirection, allows a hacker to redirect a user to any arbitrary URL address.
The vulnerability of the SCADA system Rapid SCADA is related to the use of open redirection as a result of incorrect data cleaning on the user input page. Exploiting this vulnerability allows an attacker to redirect the user to any desired URL address...
The vulnerability of the PASV mode on the Solar FTP Server allows a hacker to induce a service failure.
The vulnerability of the PASV mode on the Solar FTP Server communication server is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
The vulnerability of the MMU_UnmapPages() function in the PowerVR GPU driver for Android and ChromeOS allows a hacker to execute arbitrary code and gain elevated privileges.
The vulnerability of the MMUUnmapPages function in the PowerVR GPU driver for Android and ChromeOS systems is related to the execution of operations outside of memory buffers. Exploiting this vulnerability can allow attackers to gain increased privileges...
The vulnerability of microprogrammed software in network video recorders like SystemK NVR 504/508/516 arises from the lack of measures taken to clean data at the control level. This allows intruders to execute arbitrary commands.
The vulnerability of microprogrammed network video recorders like SystemK NVR 504/508/516 lies in the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow an intruder operating remotely to execute arbitrary commands...
The vulnerability of the Jenkins GitLab Branch Source Plugin, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to confidential information.
The vulnerability of the Jenkins GitLab Branch Source Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...
The vulnerability of the Splunk Enterprise platform for operational analysis allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Splunk Enterprise platform for operational analysis is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information using the SPL command mrollup...
The vulnerabilities of microprogramming software in AMD, Qualcomm, and Imagination allow attackers to extract data from the local memory of GPUs.
The vulnerabilities of microprogramming software for AMD, Qualcomm, and Imagination relate to insufficient isolation of the GPU’s local memory, as well as the lack of cleanup after processes are executed on the GPU. Exploiting these vulnerabilities can allow attackers to extract data from the GPU...
The vulnerability of FortiWeb web applications’ network firewalls arises from improper processing of output data for registration logs, allowing attackers to replace the traffic logs.
The vulnerability of FortiWeb web applications’ network firewalls is related to improper processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to replace traffic logs through a specially created web page...
The vulnerability of the CMS system Backdrop CMS, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.
The vulnerability of the CMS system Backdrop CMS is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
The vulnerability of the DHCP server service for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the DHCP server service for Windows operating systems is related to insufficient protection of service-related data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to vulnerabilities in access control, allows attackers to bypass security restrictions.
The vulnerabilities of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to circumvent security restrictions by synchronizing publicly...