DirectumRX (Leonid Kochegarov) (No. 1 from June 23,

...

Solar appScreener Platform Code Execution

The vulnerability of the Solar appScreener platform is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Google Chrome Graphics Processor Unauthorized Access

The vulnerability of the graphics processor in Google Chrome browsers on Android operating systems is related to the use of uninitialized variables. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HTML page...

Splunk AI Tookit Insecure Resource Initialization Unauthorized Access

The vulnerability of the software for working with Splunk AI Tookit AITK algorithms formerly known as Splunk Machine Learning Toolkit MLTK is related to insecure resource initialization due to the lack of restrictions on outgoing requests, as approved by external domains. Exploiting this...

Cisco Umbrella Virtual Appliance Privilege Escalation Command Injection

The vulnerability of the CLI interface of the Cisco Umbrella Virtual Appliance lies in the lack of access control when using the vmadmin account. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary commands...

Google Chrome Bluetooth Code Execution

The vulnerability of the Bluetooth component in Google Chrome browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...

Google Chrome Sandbox Escape

The vulnerability of Google Chrome’s user interface is related to insufficient validation of entered data. Exploiting this vulnerability can allow a malicious actor to bypass security measures by using a specially created HTML page...

Google Chrome Video Information Disclosure

The vulnerability of the Google Chrome browser’s Video component is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to obtain confidential information through a specially created HTML page...

Google Chrome ServiceWorker Code Execution

The vulnerability of Google Chrome’s ServiceWorker interface relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code through a specially created HTML page...

Google Chrome Sandbox Escape

The vulnerability of the Read Anything component in the Google Chrome browser is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to escape the sandbox environment by using a specially created HTML page...

Google Chrome New Tab Page Data Compromise

The vulnerability of the New Tab Page component in the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of protected information through a specially created HTML page...

Google Chrome Media Code Execution

The vulnerability of the Google Chrome browser’s Media component relates to reading beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...

IBM Storage Protect Server SQL Injection Unauthorized Access

The vulnerability of the IBM Storage Protect Server formerly Tivoli Storage Manager software platform lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

Oracle WebCenter Content Full Control

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to gain full control over the application...

WinCC Certificate Manager Unauthorized Access

The vulnerability of the WinCC Certificate Manager in WinCC SCADA systems is related to the unencrypted storage of credentials. Exploiting this vulnerability could allow an intruder to gain unauthorized access to protected information...

bttool Configuration Helper Arbitrary Command Execution

The vulnerability of the btool Configuration Helper tool of the Splunk AI Tookit formerly Splunk Machine Learning Toolkit MLTK relates to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker t...

Cisco Webex App URL Redirection

The vulnerability of the Cisco Webex App for collaborative work relates to the redirection of the URL to an unreliable website as a result of incorrect processing of HTTP request parameters. Exploiting this vulnerability allows a malicious actor to redirect users to any desired URL address...

Google Chrome Bluetooth Code Execution

The vulnerability of the Bluetooth component in Google Chrome browser relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created HTML page...

Google Chrome Password Access Disclosure

The vulnerability of the Password component in the Google Chrome browser is related to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to protected information through a specially created HTML page...

Google Chrome Data Source Confirmation

The vulnerability of Google Chrome is related to a data source confirmation error. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...

Google Chrome Password Bypass

The vulnerability of the Password component in Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...

Google Chrome SVG Code Execution

The vulnerability of the SVG component in Google Chrome browser is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

Google Chrome Use-After-Free

The vulnerability of Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created HTML page...

Google Chrome iOS Unauthenticated Access

The vulnerability of Google Chrome browser on iOS operating systems is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

Oracle WebCenter Content Unauthorized Access

The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform is related to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PHP mbregexuringencoding() DoS

The vulnerability of the mbregexuringencoding function in the PHP interpreter is related to discrepancies in the lists of encodings between the Oniguruma library and mbfl, as a result of a pointer assignment error. Exploiting this vulnerability can allow an attacker to cause a service failure...

User Remote Access Agent Privilege Escalation

The vulnerability of the Prisma Access Agent, a user remote access agent, relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

PHP urldecode DoS

The vulnerability of the urldecode function in the PHP programming language is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

UTT 1200GW DoS

The vulnerability in the web interface for managing microprogrammed network devices UTT 1200GW is related to the data being written beyond the buffer boundaries in memory when processing the sysAdmUser/sysAdmPass parameter. Exploitation of this vulnerability could allow a malicious actor to cause...

UTT 1200GW DoS

The vulnerability of the web-based interface for managing microprogrammed network devices UTT 1200GW is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow an attacker to gain full control over the...

ImageMagick Decoder DoS

The vulnerability of the decoder in the MSL console-based image editing tool ImageMagick relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a system failure...

ImageMagick MIFF DoS

The vulnerability of the MIFF encoder in the console-based ImageMagick graphics editor is related to incorrect calculations of the buffer size allocated. Exploiting this vulnerability can allow an attacker to cause a service failure...

ImageMagick MIFF DoS

The vulnerability of the MIFF decoder in the console-based ImageMagick graphics editor leads to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

UTT HiPER 1250GW DoS

The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...

NGINX Gateway Fabric DoS

The vulnerability of the gRPC-traffic routing function in the NGINX Gateway Fabric web server controller is related to improper array index checking. Exploiting this vulnerability can allow an attacker to cause service failures...

Portainer Information Disclosure

The vulnerability of the Portainer container management platform is related to the disclosure of information through query strings. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

Microsoft Office Buffer Overflow

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Microsoft Office 365 Apps for Enterprise Buffer Overflow

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these security measures...

Microsoft Office Excel 365 Apps for Enterprise Code Execution

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to numerical truncation errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Core component of the DoS

The vulnerability of the Core component of the Oracle Enterprise Command Center Framework is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data, or cause a service failure using the HTTP network protocol...

ImageMagick Uncontrolled Recursion DoS

The vulnerability of the console-based graphic editor ImageMagick is related to uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

Oracle MySQL Shell Full Control

The vulnerability of the Shell component in VS Code’s command-line and code editor client for Oracle MySQL Shell is related to improper code generation management. Exploiting this vulnerability can allow an attacker operating remotely to gain full control over the system...

Oracle MySQL Shell Full Control

The vulnerability of the Shell component in VS Code’s command-line and code editor client for Oracle MySQL Shell is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the system...

ImageMagick JP2 Decoder DoS

The vulnerability of the JP2 image decoding decoder in the console-based image editing software ImageMagick is related to a offset error of one unit. Exploiting this vulnerability can allow an attacker to cause a service failure...

Oracle Process Manufacturing Internal Operations Full Control

The vulnerability of the Internal Operations component of the Oracle Process Manufacturing Application for process development involves deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application...

Microsoft Office Memory Use After Free

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages relates to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Program Compatibility Assistant Service Privilege Escalation

The vulnerability of the Program Compatibility Assistant service for Windows systems is related to synchronization errors when using a common resource “Race Condition”. Exploiting this vulnerability can allow an attacker to increase their privileges...

Oracle VM VirtualBox Full Control

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain full control over the application...

Go HTTP/2 DoS

The vulnerability in the HTTP/2 implementation using the Go programming language arises from executing a loop with an unreachable exit condition when processing the value of SETTINGSMAXFRAMESIZE, which is equal to 0. Exploiting this vulnerability could allow a remote attacker to cause a service...