OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30431.

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OPJU files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30738.

MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability

MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the Save method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-29161.

Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.

Deserialization of Untrusted Data in Telerik Reporting Report Designers

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

git: Git: Arbitrary code execution via unsafe submodule metadata during recursive clones

A flaw was found in Git. Unsafe handling of submodule-related repository metadata during recursive clone operations can lead to arbitrary code execution. A remote attacker could exploit this vulnerability by supplying a crafted repository that triggers unauthorized command execution on the host system when cloned recursively.

Insufficient Granularity of Access Control in Git

Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe

Out-of-bounds Write in Git

Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures

Out-of-bounds Read in Git

Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size

Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt

An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).

A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password

TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability

Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.

Windows Text Services Framework Elevation of Privilege Vulnerability

Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

Windows Kerberos Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Missing authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows COM+ Event System Service Information Disclosure Vulnerability

Buffer over-read in Windows COM+ Event System Service allows an authorized attacker to disclose information locally.

Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability

Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.

Windows Schannel Remote Code Execution Vulnerability

Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.

Authenticated command injection

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.