Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2024-27335

Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22018.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kofax Tungstenautomation
Products
Power Pdf Power Pdf
CVE-2024-0530

CXBSoft Post-Office HTTP POST Request reg_go.php sql injection

A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /apps/reg_go.php of the component HTTP POST Request Handler. The manipulation of the argument username_reg leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250700. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cxbsoft
Products
Post-office
CVE-2024-27336

Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22022.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tungstenautomation
Products
Power Pdf
CVE-2024-0531

Tenda A15 Web-based Management Interface setBlackRule stack-based overflow

A vulnerability was found in Tenda A15 15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/setBlackRule of the component Web-based Management Interface. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250701 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Tenda
Products
A15 A15 Firmware
CVE-2024-0539

Tenda W9 httpd formQosManage_user stack-based overflow

A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Tenda
Products
W9 W9 Firmware
CVE-2024-27337

Kofax Power PDF TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Kofax Power PDF TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22033.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kofax Tungstenautomation
Products
Power Pdf Power Pdf
CVE-2024-0540

Tenda W9 httpd formOfflineSet stack-based overflow

A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. Affected is the function formOfflineSet of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
W9 W9 Firmware
CVE-2024-27338

Kofax Power PDF app response Out-Of-Bounds Read Remote Code Execution Vulnerability

Kofax Power PDF app response Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation of the app.response method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22588.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kofax Tungstenautomation
Products
Power Pdf Power Pdf
CVE-2024-0546

EasyFTP LIST Command denial of service

A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250715.

CVSS 3.1 · 5.3 Medium EPSS 6.8% KEV · Not listed
Vendors
Easyftp
Products
Easyftp
CVE-2024-27339

Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22925.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Tungstenautomation
Products
Power Pdf
CVE-2023-35075

HTML injection via channel autocomplete

Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though. 

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost
CVE-2024-27340

Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22926.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kofax Tungstenautomation
Products
Power Pdf Power Pdf
CVE-2024-27341

Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22927.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Tungstenautomation
Products
Power Pdf
CVE-2024-20721

T5 Acrobat JS vulnerability - Exploitable crash via t5::javascript::get_page_num_words

Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Microsoft
Products
Acrobat Edge Chromium
CVE-2024-27342

Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22928.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kofax Tungstenautomation
Products
Power Pdf Power Pdf
CVE-2024-0314

XSS vulnerability in FireEye Central Management

XSS vulnerability in FireEye Central Management affecting version 9.1.1.956704, which could allow an attacker to modify special HTML elements in the application and cause a reflected XSS, leading to a session hijacking.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fireeye
Products
Central Management
CVE-2024-0315

Remote file inclusion vulnerability in FireEye Central Management

Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fireeye
Products
Central Management
CVE-2024-0317

Cross-Site Scripting in FireEye EX

Cross-Site Scripting in FireEye EX, affecting version 9.0.3.936727. Exploitation of this vulnerability allows an attacker to send a specially crafted JavaScript payload via the 'type' and 's_f_name' parameters to an authenticated user to retrieve their session details.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fireeye
Products
Ex 3500 Ex 3500 Firmware Ex 5500 and 3 more
CVE-2024-0320

Cross-Site Scripting in FireEye Malware Analysis (AX)

Cross-Site Scripting in FireEye Malware Analysis (AX) affecting version 9.0.3.936530. This vulnerability allows an attacker to send a specially crafted JavaScript payload in the application URL to retrieve the session details of a legitimate user.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fireeye
Products
Malware Analysis
CVE-2023-40610

Apache Superset: Privilege escalation with default examples database

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.

CVSS 3.1 · 6.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Apache
Products
Superset