APISIX Forward-Auth Spoofing

The vulnerability of the forward-auth plugin for the Apache APISIX cloud API gateway is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

Endpoint Manager Mobile Arbitrary Command Execution

The vulnerability of the Ivanti Endpoint Manager Mobile EPMM application for managing the lifecycle of mobile devices and mobile applications formerly known as MobileIron Core is related to the failure to implement measures to neutralize specific elements. Exploiting this vulnerability allows a...

Java Program Testing Tool XSS

The vulnerability of the Java program testing tool for connecting to JDBC databases in SAP NetWeaver AS Java software solutions is related to the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...

Adobe SDK DNG Buffer Overflow Info Disclosure

The vulnerability of the DNG file reading and writing software developed by Adobe’s SDK is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to disclose confidential information by opening the malicious file...

NGINX Plus/Open Source Unauthorized Access

The vulnerability of the ngxhttpcharsetmodule module in NGINX Plus and NGINX Open Source web servers relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service...

SAP Master Data Governance Review Match Groups Privilege Escalation

The vulnerability of the “Review Match Groups Application” component in the SAP Master Data Governance data management platform is related to deficiencies in the authorization process. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

SAP Business Objects Business Intelligence Platform Data Source Confirmation

The vulnerability of the SAP Business Objects Business Intelligence Platform is related to deficiencies in the mechanism for verifying data sources. Exploiting this vulnerability could allow a malicious actor to replace the sender of an email message...

SINEC INS Network Management SINEC INS Network Management

The vulnerability of the endpoint /api/sftp/uploadFiles in the SINEC INS network management software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with system user privileges...

Direct Rendering Infrastructure Kernel Module Heap Buffer Overflow DoS

The vulnerability of the drmcopyfield function in the drivers/gpu/drm/drmioctl.c file of the Direct Rendering Infrastructure DRI driver in the Linux kernel is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

vp_vdpa_remove() Heap Buffer Overflow DoS

The vulnerability of the vpvdparemove function in the drivers/vdpa/virtiopci/vpvdpa.c file of the vDPA device driver in the Linux operating system is related to improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause service failure...

Linux RPC Protocol Heap Buffer Overflow DoS

The vulnerability of the svcrdmacopyInlinerange function in the net/sunrpc/xprtrdma/svcrdmarw.c module of the Linux operating system’s RPC protocol is related to an improper check of the specified index, position, or offset in the input data. Exploiting this vulnerability could allow an attacker ...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the qcomaddsysmonsubdev function in the drivers/remoteproc/qcomsysmon.c module of the Linux kernel subsystem for remote processors is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

ABAP Application Server Privilege Escalation

The vulnerability of ABAP application servers and SAP NetWeaver AS ABAP/ABAP Platform software integration platforms is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

JetBrains Hub Host Key RNG Error

The vulnerability of the JetBrains Hub account management software is related to errors in the code of the pseudorandom number generator used for generating host keys. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application...

DNS Request Processing DoS

The vulnerability of the DNS request processing mechanism in the BIND DNS server’s named daemon is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

BIND GSS-API Token DoS

The vulnerability of the GSS-API token processing module of the TKEY authentication mechanism’s DNS server BIND relates to the absence of a reference to an active, allocated resource. Exploiting this vulnerability can allow a malicious actor to cause service failures...

JetBrains YouTrack Authentication Bypass Privilege Escalation

The vulnerability of the JetBrains YouTrack project management tool and the JetBrains Hub account management software is related to the lack of authentication for a critical function. Exploiting this vulnerability can allow an attacker to bypass security restrictions, gain unauthorized access to...

Linux skbuff Privilege Escalation

The vulnerability of the skbuff network component in Linux operating systems is related to insufficient resource control during its existence. Exploiting this vulnerability can allow attackers to enhance their privileges...

NGINX Plus Proxy Module Code Execution

The vulnerability of the ngxhttpproxyv2module and ngxhttpgrpcmodule modules in NGINX Plus and NGINX Open Source web servers stems from the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service...

Oracle Financial Services Customer Screening Unauthorized Access

The vulnerability of the User Interface component of the Oracle Financial Services Customer Screening software lies in an incorrect authentication procedure. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to the device through HTTP requests...

JetBrains Hub Insufficient Control Privilege Escalation

The vulnerability of the JetBrains Hub account management software is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions, gain unauthorized access to protected...

Cacti rrd_substitute_host_query_data Code Execution

The vulnerability of the rrdsubstitutehostquerydata function in the Cacti network monitoring software is related to the failure to take measures to eliminate special elements in the output data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

BIND DNS Resource Release DoS

The vulnerability of the BIND DNS server is related to resource release errors. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Oracle Identity Manager Connector DoS

The vulnerability of the Core component of the Oracle Identity Manager Connector, a software solution for managing user accounts and access rights, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

ADPatch Oracle E-Business Suite Full Access

The vulnerability of the ADPatch component in the Oracle Application Management and Support System, which is part of the Oracle E-Business Suite, is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain full access to the device remotely...

ADF Faces Framework Full Access

The vulnerability of the ADF Faces framework, which is used for accelerating the development of corporate applications, is related to lack of access control mechanisms. Exploiting this vulnerability can allow an attacker to gain full access to the device...

Core server component Unauthorized Access

The vulnerability of the Core server component of Oracle HTTP Server is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the device through HTTP requests...

Microsoft Exchange Online Privilege Escalation

The vulnerability of Microsoft Exchange Online corporate email service is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Microsoft Edge Data Substitution

The vulnerability of Microsoft Edge relates to the lack of measures taken to protect the structure of a web page. Exploiting this vulnerability can allow a malicious actor to perform data substitution remotely...

GoLand Code Execution

The vulnerability of the GoLand integrated development environment is related to incorrect external control of file names or file paths. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Business Chat function Microsoft 365 Copilot Privilege Escalation

The vulnerability of the Business Chat function in Microsoft 365 Copilot relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

OSGeo GeoServer writeMasterPasswordInfo Code Execution Sensitive Information

The vulnerability of the writeMasterPasswordInfo method in the software for managing and publishing geodata on the OSGeo GeoServer server is related to improper external management of file names or paths. Exploiting this vulnerability could allow an attacker to execute arbitrary code, disclose...

Microsoft 365 Copilot Data Cleaning Access

The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability could allow a malicious actor to gain read and edit access to data...

BIND DNS-Sec DoS

The vulnerability of the BIND DNS-server’s DNSSEC verification module lies in the lack of protection for input data during cyclic operations. Exploiting this vulnerability allows a malicious actor to cause service failures...

Core Component Oracle Identity Manager Unauthorized Access

The vulnerability of the Core component of the Oracle Identity Manager Connector relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the device through HTTP requests...

Common Core Empirica Signal Privilege Escalation

The vulnerability of the Common Core analytical software component for pharmaceutical monitoring, Oracle Life Sciences Empirica Signal, is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to add, delete, or modify protected information remotely...

Oracle Financial Services Analytical Applications Infrastructure Unauthorized Access

The vulnerability of the Oracle Financial Services Analytical Applications Infrastructure platform component related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the device through HTTP requests...

Microsoft 365 Copilot Auth Bypass Info Disclosure

The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow a malicious actor to disclose confidential information remotely...

Linux kernel remove_waiter futex_requeue rt_mutex_adjust_prio_chain Use-After

The vulnerabilities of the removewaiter, futexrequeue, and rtmutexadjustpriochain functions in the Linux operating system’s kernel relate to the possibility of memory usage after deallocation. Exploiting these vulnerabilities could allow an attacker to compromise the confidentiality, integrity, a...

Oracle Financial Services Transaction Filtering UI Unauthorized Access

The vulnerability of Oracle Financial Services Transaction Filtering’s User Interface component is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through HTTP requests...

bin/solr auth Privilege Escalation

The vulnerability of the command-line utility bin/solr auth for the Apache Solr search server relates to the use of pre-installed user accounts. Exploiting this vulnerability allows an attacker to enhance their privileges and gain unauthorized access to protected information...

Linux nft_inner_parse_l2l3 Heap Buffer Overflow DoS

The vulnerability of the nftinnerparsel2l3 function in the net/netfilter/nftinner.c module of the Linux operating system is related to the use of pointer offsets that are outside their intended range when processing IPv6 packets. Exploiting this vulnerability could allow a remote attacker to gain...

Linux ICMP DoS

The vulnerability in the net/ipv4/icmp.c and net/ipv6/icmp.c modules of the Linux kernel is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to cause service failures...

Microsoft Dynamics 365 Privilege Escalation

The vulnerability of the Microsoft Dynamics 365 resource planning software is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

html-react-parser PostgreSQL XSS

The vulnerability of the html-react-parser tool used in pgAdmin 4 database management software is related to incorrect data encoding or filtering. Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks remotely...

Linux DRI Heap Buffer Overflow DoS

The vulnerability of the xegucctinitnoalloc function in the drivers/gpu/drm/xe/xegucct.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the assignment of pointers. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Network Device Driver Heap Buffer Overflow DoS

The vulnerability of the nsimdevresourcesregister function in the drivers/net/netdevsim/dev.c file of the Linux kernel’s network device driver module is related to the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability could allow an attacker to caus...

netfilter Heap Buffer Overflow DoS

The vulnerability of the ipvsgetoutrt function in the net/netfilter/ipvs/ipvsxmit.c module of the netfilter component of the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the initschedextclass function in the kernel/sched/ext.c module, which is part of the Linux kernel’s resource management system, relates to improper initialization of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Kernel Spinlock DoS

The vulnerability of the dorawreadunlock function in the kernel/locking/spinlockdebug.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...