RSA BSAFE Micro Edition DoS

The vulnerabilities of the RSA BSAFE Micro Edition Suite and Oracle Security Service, the Oracle Database Server database management system, the Oracle Communications IP Service Activator network software, and the Enterprise Manager Ops Center virtualization management system are due to numerical...

i40e controller drivers DoS

The vulnerability of Intel Ethernet Series 700 controller drivers i40e exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures...

Cisco Webex Network Recording Player Code Execution

The vulnerability of the Cisco Webex Network Recording Player and Cisco Webex Player for Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created file...

D-Link Router Code Execution

The vulnerability of D-Link DIR-655, D-Link DIR-866L, D-Link DIR-652, and D-Link DHP-1565 router microprogramming software is related to insufficient testing of the arguments passed in the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a...

Google Chrome Input Validation Bypass

The vulnerability of Google Chrome exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to circumvent navigation restrictions using a specially created extension...

FAAD2 ifilter_bank DoS

The vulnerability of the ifilterbank function in the Freeware Advanced Audio Decoder 2 FAAD2 is related to the swapping of the zero pointer. Exploiting this vulnerability could allow a hacker to cause a service failure...

fly-admin-local-se Component Data Compromise

The vulnerability of the fly-admin-local-se component in the FLY operating system of Astra Linux is related to logging errors when changing user privileges, as well as errors in creating rules for devices with the same name. Exploiting this vulnerability can allow attackers to compromise data...

Moxa EDS-G516E EDS-510E Default HTTP Interception Data Compromise

The vulnerability of the microprogrammed software of Moxa EDS-G516E and Moxa EDS-510E switches is related to the default use of the HTTP protocol in implementing the “Basic HTTP Authentication” method. Exploiting this vulnerability allows a malicious actor to remotely intercept administrator...

ImageMagick CLIListOperatorImages Buffer Overflow DoS

The vulnerability of the CLIListOperatorImages function MagickWand/operation.c in the ImageMagick console graphics editor is caused by resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

PDFium PDF Content Processor DoS

The vulnerability of the PDFium browser’s PDF-content processing component in Google Chrome is caused by a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted web page...

FortiOS Web Interface Cross Site Fraudulently

The vulnerability in the FortiOS operating system’s web interface is related to the lack of authentication for requests. Exploiting this vulnerability allows a malicious actor to perform cross-site forgery of requests to pages like /logindisconnect/disconnectadmins or...

Google Chrome Data Compromise

The vulnerability of the Google Chrome web browser’s page extraction mechanism is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information through a specially...

ImageMagick ComplexImages Information Disclosure

The vulnerability of the ComplexImages function MagickCore/fourier.c in the console-based graphic editor ImageMagick involves reading beyond the buffer boundaries in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service failures or disclose protected informati...

HP Color LaserJet Pro Data Compromise

The vulnerability of HP Color LaserJet Pro and HP LaserJet Pro printer software exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity of the protected information...

UEFI BIOS Code Error

The vulnerability of UEFI BIOS software in desktop computers, personal computers, and payment devices manufactured by Hewlett-Packard Development Company L.P. is related to code errors. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibili...

ImageMagick WritePNMImage Buffer Overflow

The vulnerability of the WritePNMImage function in the console-based image editing tool ImageMagick is related to the execution of operations beyond the buffer’s boundaries. Exploiting this vulnerability could allow a remote attacker to cause service interruptions or execute arbitrary code using ...

HP Support Assistant Access Control Privilege Escalation

The vulnerability of the HP Support Assistant software for centralized device management is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to gain system privileges and perform unauthorized changes to catalogs or files...

Linux memcpy_fromiovecend Heap Buffer Overflow DoS

The vulnerability of the memcpyfromiovecend function in the Linux operating system is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

JunOS Security Configuration Data Compromise

The vulnerability of the JunOS operating system is related to security configuration errors due to reserved multicast addresses like 224.0.0.x not being correctly aligned with addresses like 224.x.x.x. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected...

Microsoft SharePoint XSS

The vulnerability of the Microsoft SharePoint software package is related to insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute cross-site scripting attacks with elevated privileges using a specially created...

dvips Code Execution

The vulnerability of the dvips application in the TeX Live typesetting system arises from buffer overflows during the processing of command-line parameters. Exploiting this vulnerability can allow an attacker to cause a malfunction of the application or execute arbitrary code by entering a...

TEE OS Trusted Core Buffer Overflow

The vulnerability of the startTAtask function with a offset of 0x137F7C in the SMC handler of the operating system TEE OS Trusted Core in the microprogramming environment of the Huawei Mate 9 Pro mobile phone is related to the assignment of an untrusted pointer. Exploiting this vulnerability can...

Cisco Application Policy Infrastructure Controller Encryption Key Deletion Privilege Escalation

The vulnerability of the Cisco Application Policy Infrastructure Controller automation tool is related to errors in the mechanism for deleting encryption keys. Exploiting this vulnerability could allow an attacker to gain access to protected information...

PHP xml_elem_parse_buf Heap Buffer Overflow

The vulnerability of the xmlelemparsebuf function ext/xmlrpc/libxmlrpc/xmlelement.c in the PHP interpreter is related to reading data beyond the boundaries of the memory buffer. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected data...

SIMATIC PLC Input Validation

The vulnerability of microprogrammed software in programmable logic controllers from SIMATIC is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious individual to cause malfunctions in service operations by sending specially crafted packets to po...

Oracle MySQL Connector/J Full Control

The vulnerability of the Connector/J sub-component of the MySQL Connectors component of the Oracle MySQL database management system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to gain full control over the application using the JDBC protocol...

Oracle CRM Technical Foundation Preferences Data Access

The vulnerability of the Preferences sub-component of the Oracle CRM Technical Foundation component of the Oracle E-Business Suite is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data using the HTTP protoco...

Cisco IP Phones DoS

The vulnerability of the web interface of Cisco IP phones—IP Phone 8800, IP Conference Phone 8832, IP Phone 8821, and IP Phone 8821-EX—is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Pelco Sarix Web Interface Command Execution

The vulnerability of the WEB interface of Pelco Sarix Enhanced camera software systems is related to insufficient verification of input data. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary commands through the WEB interface...

Microsoft Edge ChakraCore RCE

The vulnerability of Microsoft Edge’s JavaScript ChakraCore engine is related to memory object handling flaws. Exploiting this vulnerability can allow a remote attacker to trigger memory corruption and execute arbitrary code through a specially crafted web page...

Python-gnupg Information Encryption Code Execution

The vulnerability of the gnupg.GPG.encrypt and gnupg.GPG.decrypt methods of the Python-gnupg encryption library exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Java Advanced Management Console Unauthorized Access

The vulnerability of the Java Advanced Management Console Server component of the Oracle Java SE software platform is related to insufficient access control. Exploiting this vulnerability may allow an attacker operating remotely to gain unauthorized access to protected data or cause service...

APT RCE

The vulnerability in the software of apt is related to improper cleaning of the redirecting field 302 in the HTTP method. Exploiting this vulnerability allows a remote attacker to perform content injection MITM and execute code on the target machine...

Picketlink StaxParserUtil Disclosure

The vulnerability of the StaxParserUtil class in Picketlink software for managing security and application identification in Java applications is related to deficiencies in the processing of input data during SAML message analysis. Exploiting this vulnerability allows a malicious actor to disclos...

Qemu-NBD Maintenance Failure

The vulnerability of the Qemu-NBD hardware emulation server of QEMU is related to errors during connection establishment. Exploiting this vulnerability allows a remote attacker to cause a service failure by disconnecting the server from the client upon attempting to establish a connection...

Microsoft JET Database Engine Code Execution

The vulnerability of the Microsoft JET Database Engine database driver for the Windows operating system exists due to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created file...

ChakraCore Microsoft Edge Code Execution

The vulnerability of the ChakraCore JavaScript script handler in the Microsoft Edge browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, through a...

Catalog Service Component Code Execution

The vulnerability of the Google Chrome browser’s Catalog Service component exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a specially crafted HTML page from a remote location...

VBScript Script Handler Code Execution

The vulnerability of VBScript script handlers in Windows operating systems arises from the execution of an operation beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, either through a specially crafted web page or a Microsoft...

Solaris Kernel DoS

The vulnerability of the Kernel component of the Solaris operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service failures through RPC calls...

Outside In Filters Component Unauthorized Access

The vulnerability of the Outside In Filters component within the software development kit SDK of Outside In Technology is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected data or cause service failures...

JD Edwards EnterpriseOne Tools Unauthorized Access

The vulnerability of the Monitoring and Diagnostics component of the JD Edwards EnterpriseOne Tools system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

Trade Management UI Unauthorized Access

The vulnerability of the User Interface component of the Trade Management business platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

WebLogic Server WLS-Web Services Full Control

The vulnerability of the WLS-Web Services component of the WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application using the HTTP protocol...

Solaris Cluster NAS Device Addition Full Control

The vulnerability of the NAS Device Addition component in the Solaris Cluster software lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the RPC network protocol...

PouchBD MapReduce Code Execution

The vulnerability of the map/reduce function implementation in the PouchBD database is related to deficiencies in code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code or system commands remotely...

Cisco Policy Suite Policy Builder Database Access Modification

The vulnerability of the Policy Builder database in the Cisco Policy Suite software for policy management lies in the absence of a authentication mechanism for accessing the database. Exploiting this vulnerability could allow an attacker to gain direct access to the Policy Builder database and...

InduSoft Web Studio TCP/IP Code Execution

The vulnerability of the TCP/IP component in InduSoft Web Studio and InTouch Machine Edition HMI/SCADA systems arises from buffer overflows due to deficiencies in input data processing tags, events, signaling messages. Exploiting this vulnerability allows a remote attacker to execute arbitrary co...

DTISQLInstaller.exe Gain Access

The vulnerability of the DTISQLInstaller.exe executable file of the software package for interacting with QuicDoc and Office Therapy clients is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the softwar...

Linux ALSA/dev/snd/timer driver Information Disclosure

The vulnerability of the ALSA/dev/snd/timer driver sound/core/timer.c in the Linux operating system is related to the disclosure of information during simultaneous data reading and analysis. Exploiting this vulnerability can allow an attacker, operating locally, to obtain confidential information...