Juniper Networks Junos OS Auth Bypass

The vulnerability of Juniper Networks’ Junos OS Evolved operating system is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary commands using the sysmanctl command...

Oracle MySQL Server Shell Component

Shell component vulnerability: The Admin/InnoDB Cluster of the Oracle MySQL Server database management system is vulnerable due to insufficient protection for operational data. Exploiting this vulnerability could allow an attacker to gain full control over the application using the MySQL protocol...

Emerson Rosemount X-STREAM Enhanced Unauthorized Access

The vulnerability of Emerson Rosemount X-STREAM Enhanced flow analyzers’ microprogramming software relates to the ability to send a cookie session file. Exploiting this vulnerability could allow an unauthorized actor to gain unauthorized access to protected information...

VMware Aria Operations Monitoring Tool Code Execution

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and increase their privileges...

ftusbbus2.sys Driver Failure

The vulnerability of the ftusbbus2.sys driver, a component of the IoControlCode utility in FabulaTech USB for Remote Desktop, is related to pointer assignment errors. Exploiting this vulnerability could allow an attacker to cause service failures...

D-Link DCS-825L DoS

The vulnerability of the microprogrammed software of the D-Link DCS-825L network camera relates to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending a large number of specially crafted network packets SYN...

Microsoft SharePoint Server Code Execution

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

Backup Exec Lack of Authentication Privilege Escalation

The vulnerability of Backup Exec’s backup and recovery software is related to deficiencies in authentication procedures when using the SHA cryptographic algorithm. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary commands...

SQL ODBC Plugin DoS

The vulnerability of the SQL ODBC plugin for the cross-platform development framework for Qt software relates to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures by using specially created data...

OSGeo GeoServer SQL Injection

The vulnerability of the software for managing and publishing geodata on the OSGeo GeoServer server is related to the lack of measures taken to neutralize special elements used in SQL queries. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code by sending a...

PHP Snappy generateFromHtml Code Execution

The vulnerability of the generateFromHtml function in the PHP Snappy library is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Nighthawk WiFi Router CSRF

The vulnerability of Nighthawk WiFi 6 Router RAX30’s microprogramming software is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a remote attacker to execute a CSRF attack...

Secure Access Management System IED Siemens RUGGEDCOM CROSSBOW SQL Injection

The vulnerability of the audit log management mechanism of the Secure Access Management System for IED Siemens RUGGEDCOM CROSSBOW is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL...

ProMIS InSCADA Error Message Protection

The vulnerability of the SCADA system ProMIS InSCADA is related to improper protection of error messages sent out. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

AMD security processor BIOS DoS

The vulnerability of AMD’s microprogrammed security processor BIOS systems is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Windows OS Privilege Escalation

The vulnerability of the installed Windows operating system on HP laptops relates to incorrect path name restrictions for the restricted access directory. Exploiting this vulnerability can allow attackers to gain increased privileges...

WAGO PLC Code Execution

The vulnerability of the web-based interface for controlling WAGO PFC100/PFC200, CC100, Edge Controller, and WAGO Touch Panel 600 programmable logic controllers is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker operating...

Adobe Connect Instant Messaging Access Control

The vulnerability of Adobe Connect’s instant messaging program is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

Azure Application Service Privilege Escalation

The vulnerability of Azure application services in Azure Stack is related to access control errors. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

Dell Container Storage Modules Code Execution

The vulnerability of the Dell Container Storage Modules relates to an uncontrolled DLL search process. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Fortinet FortiNAC keyUpload Code Execution

The vulnerability of the keyUpload component in the Fortinet FortiNAC network access control device is related to improper external management of file names or file paths. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted HTTP...

Power BI report server Spear Phishing

The vulnerability of the Power BI report server is related to errors in the way information is presented by the user interface. Exploiting this vulnerability could allow a malicious actor to carry out spear-phishing attacks remotely...

Adobe After Effects Heap Buffer Overflow

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in the writing of code beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code within the context of the current user...

Cisco TelePresence CE RoomOS Cryptographic Step Missing

The vulnerability of Cisco TelePresence CE and RoomOS software for Cisco Touch 10 devices is related to the absence of mandatory cryptographic steps. It exists due to insufficient identity verification during the pairing process. Exploiting this vulnerability can allow an attacker operating...

StruxureWare Data Center Expert XSS

The vulnerability of the StruxureWare Data Center Expert monitoring system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

vRealize Log Insight DoS

The vulnerability of the vRealize Log Insight log management tool is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure due to the deserialization of unreliable data...

Cisco Small Business RV340 Router File Load

The vulnerability of the web interface for managing microprogrammed software routers of Cisco Small Business RV340, RV340W, RV345, and R345P is related to the ability to load files of a malicious nature without limitation. Exploiting this vulnerability allows an attacker to upload arbitrary files...

libssh2 Man-in-the-Middle

The vulnerability of the libssh2 library, which implements Git methods in C using Libgit2, is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...

xtables-nft-multi Memory Leak

The vulnerabilities of the xtables-nft-multi and xtables-legacy-multi tools in the iptables package of the EMIAS OS operating system are related to memory release errors. Exploiting these vulnerabilities can allow an attacker to cause service failures or other adverse effects...

Linux driver RNDIS Wlan Buffer Overflow

The vulnerability in the driver drivers/net/wireless/rndiswlan.c of the Linux operating system is related to a numerical overflow in the buffer of the rndisqueryoid function during addition operations. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

CentOS Web Panel Login Command Execution

The vulnerability of the login/index.php implementation of the server management application for CentOS Web Panel is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

AMI MegaRAC BMC Full Access

The vulnerability of the microprogramming software of the AMI MegaRAC Baseboard Management Controller BMC relates to the use of rigidly encrypted credentials. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain full access to the device via SSH...

Windows Graphics Privilege Escalation

The vulnerability of the Windows Graphics component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Jenkins Git Client Plugin SSH Host Key Verification Man-in-the-Middle

The vulnerability of the SSH Host Key Verification component in the Jenkins Git Client Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” attack remotely...

Microsoft ODBC OS Driver Code Execution

The vulnerability of the Microsoft ODBC operating system driver exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Websoft HCM Automation Software XSS

The vulnerability of Websoft HCM’s HR automation software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Cisco Identity Services Engine DoS

The vulnerability of the Cisco Identity Services Engine ISE network policy management platform is related to inadequate management of system resources. Exploiting this vulnerability could allow a malicious actor to trigger a service failure through specially created RADIUS traffic...

D-Link DIR-1935 Router SetIPv6FirewallSettings Code Execution

The vulnerability of the SetIPv6FirewallSettings function in the web interface for managing D-Link DIR-1935 router microprogramming software is related to the failure to sanitize input data in the string entered by the user when processing the IPv6FirewallRule element. Exploiting this vulnerabili...

WSL2 Privilege Escalation

The vulnerability of the compatibility subsystem’s kernel for running Linux applications is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Windows ALPC Privilege Escalation

The vulnerability of the Advanced Local Procedure Call ALPC in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

Cisco Nexus Insights Unauthorized Access

The vulnerability of the web interface of the Cisco Nexus Insights system, which is used for automating, tracking, and analyzing the switching structure of data centers, is related to the use of files and directories accessible to external parties when RBAC-based access control filters are applie...

Cisco AsyncOS SQL Injection

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of the Cisco Email Security Appliance ESA and the Cisco Secure Email and Web Manager devices relates to the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious...

Moxa MXView Path Traversal

The vulnerability of the Moxa MXView network control software relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to files...

Samba Symbolic Link Access

The vulnerability of the Samba networking communication package is related to errors in processing symbolic links. Exploiting this vulnerability can allow a remote attacker to gain access to the server’s file system...

Moxa MXView Code Execution

The vulnerability of the Moxa MXView network control software is related to deficiencies in checking the path name to the restricted-access directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

InspIRCd Use-After-Free DoS

The vulnerability of InspIRCd relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

LibRaw Heap Buffer Overflow DoS

The vulnerability of the kodakradcloadraw function in the dcrawcommon.cpp component of the LibRaw image processing library is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created POC file...

NPM vm2 Code Execution

The vulnerability of the NPM packet manager’s vm2 library is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

NAS Storage Uncontrolled Format String

The vulnerability of NAS storage systems Network Attached Storage such as NAS326, NAS540, and NAS542 is related to the use of uncontrolled format strings. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created UDP packet...

Vim do_tag() Function Use-After-Free

The vulnerability of the dotag function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...