97943 matches found
ProofreadPage Extension XSS
The vulnerability of the ProofreadPage extension, a software tool for implementing the MediaWiki hypertext environment, exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attac...
Apache Aurora Information Disclosure
The vulnerability of the Apache Aurora task scheduler framework is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
Flowmon Web Interface Command Execution
The vulnerability of the web interface for controlling the Flowmon operating system in devices for network monitoring exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute...
Tenda AC10U formSetClientState XSS
The vulnerability of the formSetClientState function /goform/SetClientState in the Tenda AC10U router’s microprogramming software lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...
Ruby StringIO Ungetbyte Ungetc Data Compromise
The vulnerability of the ungetbyte and ungetc methods in the StringIO string handling utilities in the Ruby programming language is related to the escape of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality o...
Google Chrome V8 Engine Code Execution
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Schneider Electric EcoStruxure IT Gateway Privilege Escalation
The vulnerability of Schneider Electric EcoStruxure IT Gateway software for communication with controlled devices is related to the use of pre-installed credentials. Exploiting this vulnerability can allow attackers to enhance their privileges...
LDAP Service Windows DoS
The vulnerability of the LDAP Lightweight Directory Access Protocol implementation in the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...
My Cloud OS SSRF
The vulnerabilities of the My Cloud OS for network storage devices, as well as the My Cloud Home and My Cloud Home Duo cloud storage services, and the SanDisk iBeacon device, are related to insufficiently checked incoming requests. Exploiting these vulnerabilities can allow attackers to execute...
Inter-Device Communication component of Privilege Escalation
The vulnerability of the Inter-Device Communication component of Cisco Firepower Threat Defense’s microprogramming-based network interface controllers, as well as the Cisco Firepower Management Center’s network management software, is related to improper code generation. Exploiting this...
Better PDF Exporter Export Plugin PDF Disclosure
The vulnerability of the Better PDF Exporter plugin for exporting PDF files from Atlassian Jira Server and Data Center lies in insufficient testing of server-side requests. Exploiting this vulnerability could allow attackers to view arbitrary PDF files...
Windows Pragmatic General Multicast Protocol Code Execution
The vulnerability of the Pragmatic General Multicast protocol implementation in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
NGINX ngx_http_v3_module DoS
The vulnerability of the ngxhttpv3module in NGINX and NGINX Plus servers is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
TC Flower Packet Filtering DoS
The vulnerability of the packet-based flow control filter in TC Flower software multi-level switches like Open vSwitch OvS is related to deficiencies in handling exceptional states due to incorrect processing of packet metadata by Geneve. Exploiting this vulnerability can allow an attacker to cau...
pskmad_64.sys Driver Privilege Escalation
The vulnerability of the pskmad64.sys driver of the Watchguard Endpoint Protection, Detection, and Response EPDR, Panda Adaptive Defense 360 Panda AD360, and Panda Dome security solutions is related to an operation that occurs outside of the buffer in memory. Exploiting this vulnerability can all...
macOS Printing Disclosure
The vulnerability of the Printing component in the macOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...
XWiki Platform Request Forgery
The vulnerability of the XWiki Platform lies in the insufficient verification of the authenticity of the requests being executed. Exploiting this vulnerability could allow a malicious actor to substitute the displayed URL with another one...
SCADA System AVEVA Edge DLL Loading Arbitrary Code Privilege Escalation
The vulnerability of the SCADA system formerly InduSoft Web Studio AVEVA Edge relates to the loading of unreliable DLL libraries. Exploiting this vulnerability allows an attacker to execute arbitrary code and increase their privileges...
Security Component Unauthorized Access
The vulnerability of the Security component in operating systems macOS, iOS, and iPadOS is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to users’ fingerprint records...
GitLab Information Disclosure
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential data...
Ultimate WP Query Search Filter Plugin XSS
The vulnerability of the Ultimate WP Query Search Filter plugin of the WordPress content management system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
GitLab API PUT Request Handler Arbitrary API PUT
The vulnerability of the API PUT Request Handler component of the software platform based on Git for collaborative code development on GitLab exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary API PUT...
IoTDB Database Code Execution
The vulnerability of the IoT database Apache IoTDB exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
FeverWarn ESP32 Code Execution
The vulnerability of the microprogramming software in FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi systems is related to the absence of authentication procedures for critical functions. Exploiting this vulnerability could allow an attacker to gain unauthorized...
PowerVR GPU graphics driver Heap Buffer Overflow DoS
The vulnerability of the PMRWritePMPageList function in the PowerVR GPU driver for Android and ChromeOS operating systems is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow attackers to gain increased privileges...
Delta Industrial Automation DOPSoft Buffer Overflow
The vulnerability of the Delta Industrial Automation DOPSoft software for designing human-machine interfaces is related to buffer overflows in the stack during syntax analysis of the wLogTitlesPrevValueLen field. Exploitation of this vulnerability could allow a malicious actor to execute arbitrar...
E-DDC3.3 Automation Station Web Interface Arbitrary Command Execution
The vulnerability of the E-DDC3.3 automation station’s web interface involves incorrect code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted web requests via the CGI protocol...
Nginx UI Arbitrary Command Execution
The vulnerability of the Nginx UI server’s user interface is related to the lack of measures taken at the management level to clean data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by modifying the startcmd parameter...
AMD
The vulnerabilities of microprogramming software for AMD, Qualcomm, and Imagination relate to insufficient isolation of the GPU’s local memory, as well as the lack of cleanup after processes are executed on the GPU. Exploiting these vulnerabilities can allow attackers to extract data from the GPU...
Cassia X1000 Code Execution
The vulnerability of the corporate Bluetooth gateway Cassia X1000 is related to the lack of measures taken to secure data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges using the queueUrl parameter in /bypass/conf...
Totolink N350RT Router Code Execution
The vulnerability of the loginAuth function /cgi-bin/cstecgi.cgi in the Totolink N350RT router software lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
UMC software Product Management Heap Buffer Overflow DoS
The vulnerability of the UMC software product management components, including Opcenter Quality, SIMATIC PCS neo, SINUMERIK Integrate RunMyHMI/Automotive, Totally Integrated Automation Portal TIA Portal, is related to the use of an unauthorized intermediate policy file. Exploiting this...
D-Link G416 Router Code Execution
The vulnerability of the flupl querytype function in D-Link G416 router microprogramming software relates to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by...
D-Link G416 Router Code Execution
The vulnerability of the flupl function in D-Link G416 router software lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by connecting to port 80...
Helix Core Code Execution
The vulnerability of the Helix Core version control software is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
SSH Protocol Packet Sequence Manipulation
The vulnerability of the SSH protocol lies in the ability to alter the sequence numbers of packets during the connection negotiation process, thereby eliminating any number of SSH protocol messages. Exploiting this vulnerability allows a malicious actor to bypass integrity checks, disable existin...
Asterisk AMI Interface File Read
The vulnerability of the AMI interface of Asterisk management systems for IP-telephony and Certified Asterisk is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read access to...
Windows Media Component Code Execution
The vulnerability of the Windows Media component in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Apache OFBiz Code Execution
The vulnerability of the Apache OFBiz resource planning software lies in improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Windows DNS Server Spoofing
The vulnerability of DNS servers in Windows operating systems is related to errors in information representation by the user interface. Exploiting this vulnerability can allow a malicious actor to perform spoofing attacks remotely...
Adobe Dimension Buffer Overflow Info Disclosure
The vulnerability of Adobe Dimension’s 3D design software relates to the execution of operations beyond the buffer boundaries in memory when processing USD format files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by creating a speciall...
Delta Electronics InfraSuite Device Master Local Privilege Escalation
The vulnerability of the Delta Electronics InfraSuite Device Master software for real-time device monitoring lies in the recovery of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute code with local administrator privileges...
Google Chrome WebRTC RCE
The vulnerability of Google Chrome’s WebRTC technology is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure through a specially created malicious web page...
Backdrop CMS XSS
The vulnerability of the CMS system Backdrop CMS is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
Libavif Encoding Code Execution
The vulnerability of the Libavif library for encoding and decoding .avif files in Google Chrome’s Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a service failure through a...
Django Denial-of-Service
The vulnerability of the Django web application framework is related to unlimited resource distribution. Exploiting this vulnerability can allow a malicious actor to trigger a Denial-of-Service attack remotely...
Adobe Prelude Uninitialized Pointer Access Unauthorized Access
The vulnerability of the cloud-based video conversion, annotation, and format conversion application for Adobe Prelude relates to access to an uninitialized pointer during processing of MP4 files. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected informati...
Adobe Experience Manager Code Execution
The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...
Android callback_thread_event Heap Buffer Overflow RCE
The vulnerability of the callbackthreadevent function comandroidbluetoothbtserviceAdapterService.cpp in the Android operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
BIG-IP HTTP/2 DoS
The vulnerability of the HTTP/2 network protocol implementation for BIG-IP access control and remote authentication mechanisms is related to an uncontrolled resource consumption during request processing. Exploiting this vulnerability could allow a malicious actor to cause service failures...