Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current us...
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by a Write-what-where Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a vic...
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a vic...
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a vic...
AFFECTED_PRODUCTS:
Adobe Substance 3d Painter
INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQne...
AFFECTED_PRODUCTS:
Inprax Izzi Connect
Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Comarch ERP XL installations.
This issue affects ERP XL: from 2020.2.2 through 2023.2...
AFFECTED_PRODUCTS:
Comarch Erp Xl
The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords.
This issue affects ERP XL:...
AFFECTED_PRODUCTS:
Comarch Erp Xl
Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.
This issue affects ERP XL: from 2020.2.2 through 2023.2.
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
AFFECTED_PRODUCTS:
Vitalpbx Vitalpbx,
Vitalpbx Vitalpbx,
Vitalpbx Vitalpbx
... (+17)
SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain sensitive information via the gwbhAIM parameter in the saveMove.jsp in the hr_position directory.
AFFECTED_PRODUCTS:
Yonyou Yonyou
Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission.
AFFECTED_PRODUCTS:
ESET Nod32 Antivirus,
ESET Smart Security,
ESET Endpoint Security
... (+29)
XSS vulnerability in DP Calendar component for Joomla.
AFFECTED_PRODUCTS:
Digital-Peak Dpcalendar
The Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers to access landing pages that may not be public.
AFFECTED_PRODUCTS:
Fatcatapps Landing Page Cat
An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. If a VxWorks task or POSIX thread that uses OpenSSL exits, limited per-task memory is not freed, resulting in a memory leak.
Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS attack by injecting malicious executable scripts into the application's code. Fixed in version A32.20...
AFFECTED_PRODUCTS:
Algosec Fireflow,
Algosec Fireflow,
Algosec Fireflow
ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory.
The bug can be triggered by a malicious bhyve gues...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd
A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause.
An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
... (+1)
The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case.
An attacker may cause the reference count to overflow, leading to a use after free (UAF).
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2021.
The jail(2) system call has not limited a visiblity of allocated TTYs (the kern.ttys sysctl). This gives rise to an information leak about processes outside the current jail.
Attacker can get information about TTYs allocated on the host or in other jails. Effectively, the information printed by "...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
`bhyveload -h <host-path>` may be used to grant loader access to the <host-path> directory tree on the host. Affected versions of bhyveload(8) do not make any attempt to restrict loader's access to <host-path>, allowing the loader to read any file the host user has access to. In the bhyveload(8) mo...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
... (+1)
URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log.
AFFECTED_PRODUCTS:
Appleple A Blog Cms
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivil...
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Red Hat Enterprise Linux Eus
... (+48)
When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled.
An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
... (+2)
The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer.
While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
... (+2)
The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO"). The e1000 device model uses an on-stack buffer to genera...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small.
Users with access to the mpr, mps or mpt device node may ov...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption.
On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host en...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could lead to kernel memory corruption.
On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail ca...
AFFECTED_PRODUCTS:
FreeBSD Freebsd,
FreeBSD Freebsd,
FreeBSD Freebsd
EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.
AFFECTED_PRODUCTS:
Ebmtech Risweb
EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login.
AFFECTED_PRODUCTS:
Ebmtech Risweb
EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even lev...
AFFECTED_PRODUCTS:
Ebmtech Uniweb\/solipacs Webserver
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
AFFECTED_PRODUCTS:
Hgiga Oaklouds Organization 2.0,
Hgiga Oaklouds Organization 3.0,
Hgiga Oaklouds Webbase 2.0
... (+1)
The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.
AFFECTED_PRODUCTS:
Hgiga Oaklouds Organization 2.0,
Hgiga Oaklouds Organization 3.0,
Hgiga Oaklouds Webbase 2.0
... (+1)
EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privi...
AFFECTED_PRODUCTS:
E-Web Fs Ezviewer
Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the cha...
AFFECTED_PRODUCTS:
Helm Helm
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges.
AFFECTED_PRODUCTS:
4Ipnet Eap 767 Firmware