RPKI Validator DoS

The vulnerability of the RPKI validator OctoRPKI is related to the use of a zero value during the generation of Route Origin Authorisations. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

LinkHub Mesh Wi-Fi AC1200 GetValue Code Execution

The vulnerability of the GetValue function in the microprogramming software for LinkHub Mesh Wi-Fi AC1200 lies in the copying of buffers without checking the size of the input data during the processing of the pann file. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

OTRS Ticket Request Administration XSS

The vulnerability of the OTRS ticket request administration interface is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Photo Station Code Execution

The vulnerability of the Photo Station photo storage app is related to privilege management errors. Exploiting this vulnerability allows an attacker to elevate their privileges within the system and execute arbitrary code...

Xstream Java Library Uncontrolled Resource Consumption

The vulnerability of the Xstream library for converting objects into XML or JSON format involves an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor to cause service failures remotely...

Infrastructure component Privilege Escalation

The vulnerability of the Infrastructure component of the Oracle Banking Trade Finance software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to create, delete, or alter access to critical data, gain read-only access to data, or cause a...

Vim utf_ptr2char() function Data Compromise

The vulnerability of the utfptr2char function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

BIG-IP DoS

The vulnerabilities of the iControl REST API interface for access control and remote authentication, the BIG-IP Access Policy Manager, the virtual server for application protection, the BIG-IP Advanced Web Application Firewall, the BIG-IP Advanced Firewall Manager, the infrastructure status...

FortiESNAC Privilege Escalation

The vulnerability of the FortiESNAC service in the Fortinet FortiClient for Windows security solution is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow attackers to increase their privileges...

Elementor Website Builder XSS

The vulnerability of the Elementor Website Builder plugin of the WordPress content management system is related to insufficient protection of the website’s structure. Exploiting this vulnerability allows a malicious actor to execute cross-site scripting attacks...

Pillow libImaging TgaRleDecode Buffer Overflow

The vulnerability of the libImaging/TgaRleDecode.c component of the Pillow image processing library is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

Cisco Expressway Series API Interface Path Bypass Privilege Escalation

The vulnerability of the API interface of Cisco Expressway Series and Cisco Telepresence VCS database devices is related to insufficient checking of arguments entered by users during command execution. Exploiting this vulnerability allows attackers to perform attacks remotely, bypassing the...

OAS Engine SecureAddSecurity Unauthorized Access

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transfer between devices and applications in the OAS Platform is related to the lack of authentication for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to ga...

Rack Modular Interface Command Injection

The vulnerability of the modular interface between web servers and Rack web applications is related to improper input validation during data processing, as transmitted through the intermediate software Rack Lint and CommonLogger. Exploiting this vulnerability allows a remote attacker to send...

Mozilla Firefox Update Downgrade

The vulnerability of the Mozilla Firefox browser is related to errors during the verification of the downloaded update. Exploiting this vulnerability can allow a malicious actor to downgrade the version of the browser during an update...

Microsoft Office Pointer Offset Code Execution

The vulnerability of the Microsoft Office package is related to a pointer offset issue during the processing of the cbHdrData element in the FEATHEADER field of BIFF format files. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain full control over the application...

HP LaserJet Professional M1210 series Code Execution

The vulnerability of the microprogramming software of the HP LaserJet Professional M1210 series multifunctional device is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow an attacker to execute arbitrary code with application privileges...

ControlWave Telemechanics Embedded Images Confidential Data Access Data Compromise

The vulnerability of embedded images of telemechanics controllers from ControlWave is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data, compromise its integrity, and even cause...

Honeywell PLC Inter-controller Protocol Plain Text Access

The vulnerability of the Inter-controller protocol implementation for Honeywell programmable logic controllers involves the transmission of PIN codes, user names, and passwords as plain text. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to protect...

Safety Manager Logic Controllers Rigidly Encoded Access

The vulnerability of Safety Manager and microprogrammed logic controllers from Honeywell Experion PKS lies in the use of strictly encrypted user data. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

ACE1000 Unauthenticated Access

The vulnerability of the microprogrammed logic controllers ACE1000 relates to the use of rigidly encoded credentials for five SSH accounts. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Hazelcast Platform Code Execution

The vulnerability of the Hazelcast platform, a software product for data processing, in the Atlassian/Bitbucket Data Center environment, relates to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...

Spring Cloud Config Path Traversal

The vulnerability of the Spring Cloud Config server exists due to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability allows a malicious actor to expose the protected information using a specially created URL address...

Jira Seraph Privilege Escalation

The vulnerability of the Jira Seraph web authentication platform is related to deficiencies in the authentication process of Jira and Jira Service Management. Exploiting this vulnerability could allow attackers, operating remotely, to increase their privileges through specially crafted HTTP...

Open Plug and Play

The vulnerability of the Open Plug and Play PnP microprogramming software for Cisco Small Business routers such as RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P exists due to the failure to take measures to neutralize the special elements used in the operating system...

Cisco Small Business RV340 DoS

The vulnerability of the web-based management interface for Cisco Small Business RV340, RV340W, RV345, and RV345P microprogramming systems lies in the insufficient handling of exceptional states. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Snort Modbus Integer Overflow DoS

The vulnerability of the Modbus protocol implementation in the intrusion detection system Snort is caused by a numerical overflow condition. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause a service failure...

Cisco IOx Path Traversal XSS

The vulnerability of the Cisco IOx software platform exists due to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perform XSS attacks remotely...

Interactive Graphical SCADA System Buffer Overflow DoS

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System IGSS, relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow a malicious actor to cause a service failure by sending a specially crafted message...

GUI temperature control software Buffer Overflow

The vulnerability of GUI temperature control software relates to the possibility of writing beyond the buffer boundaries when processing configuration files in the .gd1 format. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CKEditor Advanced Tab for Dialogs Manipulation

The vulnerability of the Advanced Tab for Dialogs plugin for the CKEditor editor is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to manipulate the content of the address bar remotely...

Glances XML External Object Access

The vulnerability of the Glances monitoring tool is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Adobe XMP-Toolkit-SDK Buffer Overflow Unauthorized Access

The vulnerability of the Adobe XMP-Toolkit-SDK lies in the creation of temporary files with insecure permissions. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

GPAC MPEG-4 Decoder Data Compromise

The vulnerability of the decoder in the MPEG-4 multimedia platform GPAC’s decoding function is related to the lack of a mechanism for converting data types. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Cluster Component Code Execution

Vulnerability of the Cluster component: General database management systems like MySQL Cluster are vulnerable due to buffer overflows in the stack. Exploitation of this vulnerability can allow an attacker to execute arbitrary code remotely...

MP4Box URL GetProtocolType DoS

The vulnerability of the URLGetProtocolType function in the MP4Box multimedia platform of GPAC is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to cause service failures using a specially created file...

Moodle Access Control Modification

The vulnerability of the virtual learning environment Moodle is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to modify course badges using criteria in the profile field...

Visual Studio Code WSL Extension Code Execution

The vulnerability of the Visual Studio Code WSL extension is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created request from a remote location...

NETGEAR Router Service Information Disclosure

The vulnerability of the embedded software of NETGEAR routers such as EX6100v2, EX6150v2, EX6250, EX6400, EX6400v2, EX6410, EX6420, EX7300, EX7300v2, EX7320, EX7700, LBR1020, LBR20, RBK352, RBK50, RBR350, RBR50, and RBS350 lies in the lack of protection for service data. Exploiting this...

NETGEAR R6300v2 Buffer Overflow

The vulnerability of the embedded software of NETGEAR routers such as R6300v2, R6400, R6900, R7000, R7900, R8000, R7900P, R8000P, RAX75, RAX80, and WNR3500v2 arises due to buffer overflows. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and...

Microsoft Exchange Server RCE

The vulnerability of Microsoft Exchange Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted data to the server...

NETGEAR Router Privilege Insecure

The vulnerability of NETGEAR R6900P, R7000, R7000P, and RS400 router’s built-in software is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

NETGEAR Integrated Router Buffer Overflow

The vulnerability of the embedded software of NETGEAR routers such as R6260, R6800, R6700v2, R6900v2, R7450, AC2100, AC2400, and AC2600 arises due to buffer overflow on the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility o...

NETGEAR EX6120 Plugin Command Injection

The vulnerability of the embedded software of NETGEAR EX6120, EX6130, EX7000, EX7500, EX3700, EX3800, RBR850, RBS850, and RBK852 lies in the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

NETGEAR Integrated Routing Software Command Injection

The vulnerability of NETGEAR’s integrated routing software, including models such as CBR750, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, stems from the lack of measures to sanitize input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

FortiMail Authentication Token Disclosure

The vulnerability of the FortiMail email security system is related to errors during the authentication process. Exploiting this vulnerability can allow a malicious actor to obtain the authentication token of the administrative account...

Zyxel NBG6604 CGI Session Access

The vulnerability of the CGI program of the Zyxel NBG6604 switch is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to gain access to the device by intercepting the authentication token...

IDEMIA Biometric Authentication Bypass

The vulnerability of IDEMIA’s biometric identification systems’ microprogramming software is related to the absence of authentication. Exploiting this vulnerability could allow a malicious actor to bypass authentication and cause service failures...

NETGEAR Wi-Fi Router Buffer Overflow

The vulnerability of NETGEAR Wi-Fi router software models such as R6400v2, R6700v3, R6900P, R7000, R7000P, RAX200, RAX75, and RAX80 lies in the writing of data beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure...

D-Link DSL-3782 Router Code Execution

The vulnerability of the index.php script in the D-Link DSL-3782 router microprogramming system is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...