Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Defender For Endpoint,
Microsoft Defender For Endpoint,
Microsoft Defender For Endpoint
... (+9)
Trusted Compute Base Elevation of Privilege Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows Server 2019,
Microsoft Windows 11 21h2,
Microsoft Windows Server 2022
... (+5)
Skype for Business Information Disclosure Vulnerability
AFFECTED_PRODUCTS:
Microsoft Skype For Business Server
Windows Hyper-V Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 21h2,
Microsoft Windows Server 2022,
Microsoft Windows 11 22h2
... (+2)
Azure Stack Hub Spoofing Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Stack Hub
Microsoft Office Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Office,
Microsoft Office,
Microsoft Office
... (+6)
Azure DevOps Server Remote Code Execution Vulnerability
AFFECTED_PRODUCTS:
Microsoft Azure Devops Server,
Microsoft Azure Devops Server,
Microsoft Azure Devops Server
Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.
AFFECTED_PRODUCTS:
Zimbra Collaboration,
Zimbra Collaboration
Insufficient verification of data authenticity in
the configuration state machine may allow a local attacker to potentially load
arbitrary bitstreams.
SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted script.
AFFECTED_PRODUCTS:
Advradius Adv Radius
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.
AFFECTED_PRODUCTS:
Zimbra Collaboration,
Zimbra Collaboration,
Zimbra Collaboration
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising th...
AFFECTED_PRODUCTS:
Zimbra Collaboration,
Zimbra Collaboration,
Zimbra Collaboration
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)
AFFECTED_PRODUCTS:
Zimbra Collaboration,
Zimbra Collaboration,
Zimbra Collaboration
In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured for Imap/smtp.
AFFECTED_PRODUCTS:
Zimbra Collaboration,
Zimbra Collaboration
Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows to read up to 0x802 of memory from ar arbitrary user-supplied pointer.
AFFECTED_PRODUCTS:
Anti-Virus Vba32
Vba32 Antivirus v3.36.0 is vulnerable to an Arbitrary Memory Read vulnerability by triggering the 0x22201B, 0x22201F, 0x222023, 0x222027 ,0x22202B, 0x22202F, 0x22203F, 0x222057 and 0x22205B IOCTL codes of the Vba32m64.sys driver.
AFFECTED_PRODUCTS:
Anti-Virus Vba32
The attacker may exploit a path traversal vulnerability leading to information disclosure.
AFFECTED_PRODUCTS:
Mapshaper Mapshaper
Twister Antivirus v8.17 is vulnerable to an Out-of-bounds Read vulnerability by triggering the 0x801120B8 IOCTL code of the filmfd.sys driver.
AFFECTED_PRODUCTS:
Filseclab Twister Antivirus
Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F, 0x80112073, 0x80112077, 0x80112078, 0x8011207C and 0x80112080 IOCTL codes of...
AFFECTED_PRODUCTS:
Filseclab Twister Antivirus
An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN.
AFFECTED_PRODUCTS:
Hima F30 03x Yy \(com\) Firmware,
Hima F30 03x Yy \(cpu\) Firmware,
Hima F35 03x Yy \(com\) Firmware
... (+10)
An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port.Â
AFFECTED_PRODUCTS:
Hima F30 03x Yy \(com\) Firmware,
Hima F30 03x Yy \(cpu\) Firmware,
Hima F35 03x Yy \(com\) Firmware
... (+10)
Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.
AFFECTED_PRODUCTS:
Honeywell Niagara Framework
Rejected reason: **REJECT** Not a valid vulnerability.
To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued...
AFFECTED_PRODUCTS:
Isc Bind,
Isc Bind,
Isc Bind
... (+8)
If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance.
This issue affects BIND 9 versions 9.11.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S...
AFFECTED_PRODUCTS:
Isc Bind,
Isc Bind,
Isc Bind
... (+21)
A bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled.
This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9....
AFFECTED_PRODUCTS:
Isc Bind,
Isc Bind,
Isc Bind
... (+13)
A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when:
- `nxdomain-redirect <domain>;` is configured, and
- the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response.
This issue affects...
AFFECTED_PRODUCTS:
Isc Bind,
Isc Bind,
Isc Bind
... (+15)
The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects bo...
AFFECTED_PRODUCTS:
Isc Bind,
Isc Bind,
Isc Bind
... (+17)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and abo...
AFFECTED_PRODUCTS:
Bold-Themes Bold Page Builder
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
AFFECTED_PRODUCTS:
Bold-Themes Bold Page Builder
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and ab...
AFFECTED_PRODUCTS:
Bold-Themes Bold Page Builder
A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content to be injected into the response when accessing the CM dashboard.
AFFECTED_PRODUCTS:
Trellix Central Management System
A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted Catia MODEL files. An attacker could leverage this vulnerability to execute code in the context of the current pr...
AFFECTED_PRODUCTS:
Siemens Simcenter Femap
A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the curr...
AFFECTED_PRODUCTS:
Siemens Simcenter Femap
A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000), Simcenter Femap (All versions < V2306.0001). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted Catia MODEL files. This could allow an attac...
AFFECTED_PRODUCTS:
Siemens Simcenter Femap
A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the curr...
AFFECTED_PRODUCTS:
Siemens Simcenter Femap
A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application is vulnerable to memory corruption while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21712)
AFFECTED_PRODUCTS:
Siemens Simcenter Femap
A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the curr...
AFFECTED_PRODUCTS:
Siemens Simcenter Femap
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location In...
AFFECTED_PRODUCTS:
Siemens Location Intelligence
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code.
AFFECTED_PRODUCTS:
Siemens Polarion Alm
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.
AFFECTED_PRODUCTS:
Siemens Sinec Nms,
Siemens Sinec Nms
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.
AFFECTED_PRODUCTS:
Siemens Sinec Nms,
Siemens Sinec Nms
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.
AFFECTED_PRODUCTS:
Siemens Sinec Nms,
Siemens Sinec Nms
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted PSOBJ files. This could allow an attac...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP file...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage thi...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage thi...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage thi...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacke...
AFFECTED_PRODUCTS:
Siemens Tecnomatix Plant Simulation,
Siemens Tecnomatix Plant Simulation