summary: Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18162.


default_status: unknown

product: FvDesigner

vendor: Fatek Automation

status: affected

ecosystem: software/application

metric_type: Primary

severity: high

metric_type: Secondary

part: a

product: fvdesigner

vendor: fatek

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18164.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18166.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18168.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18170.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18172.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18173.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18176.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18178.


summary: Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18182.


summary: Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18183.


vendor: D-Link

ecosystem: operating-system

part: o

vendor: dlink

summary: D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. A crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20552.


version_type: custom

severity: medium

summary: D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20553.


summary: D-Link DIR-2150 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20554.


summary: D-Link DIR-2150 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20555.


summary: D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20556.


summary: D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20558.


summary: D-Link DIR-2150 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20559.


summary: D-Link DIR-2150 GetFirmwareStatus Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20561.


summary: D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOAP API interface, which listens on TCP port 80 by default. A crafted authentication header can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20910.


vendor: NETGEAR

vendor: netgear

summary: NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability. This vulnerability allows physically present attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of symbolic links on removable USB media. By creating a symbolic link, an attacker can abuse the router's web server to access arbitrary local files. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-19498.


summary: NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the system configuration. The system contains a hardcoded user account which can be used to access the CLI service as a low-privileged user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19660.


summary: NETGEAR RAX30 cmsCli_authenticate Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within a shared library used by the telnetd service, which listens on TCP port 23 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19918.


product: Cobalt

vendor: Ashlar-Vellum

version: Ashlar-Vellum Cobalt 11 build 1111

product: cobalt

vendor: ashlar

summary: Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17891.


summary: Ashlar-Vellum Cobalt CO File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17892.


summary: Ashlar-Vellum Cobalt XE File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17966.


summary: Ashlar-Vellum Cobalt Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17985.


summary: Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18007.


version: Ashlar-Vellum Cobalt 12 beta build 1204.49

summary: Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B or X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18401.


summary: Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B or X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18552.


summary: Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B or X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18636.


product: DICOM Viewer Pro

vendor: Sante

vendor: santesoft

severity: low

summary: Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21086.


summary: Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21125.


summary: Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21126.


summary: Sante DICOM Viewer Pro JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21127.


product: Client

vendor: Pulse Secure

vendor: ivanti

summary: Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Pulse Secure Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within SetupService. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service. Was ZDI-CAN-17687.


summary: Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17910.


summary: Ashlar-Vellum Cobalt XE File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17948.


summary: Ashlar-Vellum Cobalt CO File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17909.


summary: Ashlar-Vellum Cobalt CO File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17865.


summary: Ashlar-Vellum Cobalt Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-17987.


summary: Ashlar-Vellum Cobalt Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IGS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18006.


summary: Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B or X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18637.


product: Graphite

version: Ashlar-Vellum Graphite v13 Special Edition. Build 13.0.46

product: graphite

summary: Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18908.


summary: Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18910.


summary: Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-18913.


version: Ashlar-Vellum Cobalt 12 beta build 1204.57

summary: Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19876.


summary: Ashlar-Vellum Cobalt Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19878.


summary: Ashlar-Vellum Cobalt Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-19879.


archetype: generic

product: qq

vendor: tencent

product: tim

status: Modified

summary: In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition.

title: Tencent Qq security vulnerability


default_status: unaffected

product: Intel(R) Simics Simulator software

version: before version 1.7.2

vendor: intel

summary: Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Simics Simulator security vulnerability


product: Intel(R) VROC software

version: before version 8.0.8.1001

summary: Incorrect default permissions in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Virtual Raid On Cpu security vulnerability


product: Infrasuite Device Master

vendor: Delta Electronics

vendor: deltaww

summary: An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file contents.

title: Deltaww Infrasuite Device Master security vulnerability


product: OAS Platform

vendor: Open Automation Software

vendor: openautomationsoftware

summary: An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to trigger this vulnerability.

title: Openautomationsoftware Oas Platform security vulnerability


default_status: affected

product: sox

product: Fedora

vendor: Fedora

product: Extra Packages for Enterprise Linux

vendor: fedoraproject

product: fedora

vendor: redhat

summary: A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure.


product: xen

vendor: xen

vendor: debian

vendor: linux

summary: The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.

title: Xen security vulnerability


vendor: arm

summary: Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the Physical Address Register (PAR_EL1) in close proximity.

title: Arm Cortex-A77 Firmware security vulnerability


summary: For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shadow root page table that the CPU in question is presently running on. While a precaution exists to supposedly prevent the tearing down of the underlying live page table, the time window covered by that precaution isn't large enough.


summary: When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some versions of C Xenstored are assuming that the quota cannot be negative and are using assert() to confirm it. This will lead to C Xenstored crash when tools are built without -DNDEBUG (this is the default).


ecosystem: linux/kernel

summary: Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the issue (on Arm32 a waiting writer doesn't block further readers to get the lock).


summary: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] libfsimage contains parsing code for several filesystems, most of them based on grub-legacy code. libfsimage is used by pygrub to inspect guest disks. Pygrub runs as the same user as the toolstack (root in a priviledged domain). At least one issue has been reported to the Xen Security Team that allows an attacker to trigger a stack buffer overflow in libfsimage. After further analisys the Xen Security Team is no longer confident in the suitability of libfsimage when run against guest controlled input with super user priviledges. In order to not affect current deployments that rely on pygrub patches are provided in the resolution section of the advisory that allow running pygrub in deprivileged mode. CVE-2023-4949 refers to the original issue in the upstream grub project ("An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.")

title: Xen security vulnerability


summary: The caching invalidation guidelines from the AMD-Vi specification (48882—Rev 3.07-PUB—Oct 2022) is incorrect on some hardware, as devices will malfunction (see stale DMA mappings) if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory ranges not owned by the guest, thus allowing access to unindented memory regions.

title: Xen security vulnerability


summary: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of the guest state, leading to denials of service. 1) CVE-2023-34327 - An HVM vCPU can end up operating in the context of a previous vCPUs debug mask state. 2) CVE-2023-34328 - A PV vCPU can place a breakpoint over the live GDT. This allows the PV vCPU to exploit XSA-156 / CVE-2015-8104 and lock up the CPU entirely.

title: Xen security vulnerability


vendor: AMI

version_type: RC

severity: critical

vendor: ami

summary: AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.


summary: AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.


summary: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.


summary: AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.


summary: AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, or data tampering.

title: Ami Megarac Sp-X security vulnerability


summary: AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections. An exploitation of this vulnerability may lead to a loss of integrity or denial of service.

title: Ami Megarac Spx security vulnerability


summary: AMI BMC contains a vulnerability in the IPMI handler, where an attacker with the required privileges can cause a buffer overflow, which may lead to code execution, denial of service, or escalation of privileges.

title: Ami Megarac Sp-X security vulnerability


summary: AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.

title: Ami Megarac Sp-X security vulnerability


summary: AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.


product: Apache Accumulo

vendor: Apache Software Foundation

version_type: semver

product: accumulo

vendor: apache

summary: Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defect in the user authentication process that may succeed when invalid credentials are provided. Users are advised to upgrade to 2.1.1.


summary: AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure, or data tampering.

title: Ami Megarac Sp-X security vulnerability


summary: AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, or data tampering.

title: Ami Megarac Sp-X security vulnerability


title: Ami Megarac Sp-X security vulnerability


summary: AMI BMC contains a vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username, which may lead to information disclosure.

title: Ami Megarac Sp-X security vulnerability


summary: AMI BMC contains a vulnerability in the SPX REST API, where an attacker with the required privileges can access arbitrary files, which may lead to information disclosure.

title: Ami Megarac Sp-X security vulnerability


vendor: Yifan

vendor: yifanwireless

summary: A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability.


vendor: Delta Electronics

summary: Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely execute arbitrary code.


product: PI Server

vendor: Aveva

vendor: aveva

summary: AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.

title: Aveva Pi Server security vulnerability


product: Intel(R) NUC BIOS firmware

version: See references

vendor: intel

summary: Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel Nuc Performance Kit And Mini Pc Nuc10I3Fnh Firmware security vulnerability


product: Intel(R) XTU software

version: before version 7.12.0.15

summary: Uncontrolled search path element in some Intel(R) XTU software before version 7.12.0.15 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Extreme Tuning Utility security vulnerability


product: Intel(R) PCM software

version: before version 202307

product: pcm

summary: Buffer underflow in some Intel(R) PCM software before version 202307 may allow an unauthenticated user to potentially enable denial of service via network access.

title: Intel Performance Counter Monitor security vulnerability


product: macOS

vendor: Apple

version: unspecified

product: watchOS

product: iOS and iPadOS

product: tvOS

ecosystem: apple/platform

product: ipados

vendor: apple

product: macos

product: tvos

product: watchos

summary: A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchOS 9.5. An attacker may be able to leak user account emails.


product: OAS Platform

vendor: Open Automation Software

vendor: openautomationsoftware

summary: An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.


product: Surf SOHO HW1

vendor: Peplink

version: v6.3.5 (in QEMU)

vendor: peplink

summary: A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to execution of arbitrary javascript in another user's browser. An attacker can make an authenticated HTTP request to trigger this vulnerability.


ecosystem: windows/system

summary: Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for linux may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Integrated Bmc Video Driver security vulnerability


summary: An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


product: HR Portal

vendor: Soar Cloud Ltd.

vendor: scshr

summary: Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account.

title: Scshr Hr Portal security vulnerability


vendor: ASUS

vendor: asus

summary: ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to a device which contains a specific user agent, causing the httpd binary to crash during a string comparison performed within web.c, resulting in a DoS condition.


summary: ASUS RT-AX88U's httpd is subject to an unauthenticated DoS condition. A remote attacker can send a specially crafted request to the device which causes the httpd binary to crash within the "do_json_decode()" function of ej.c, resulting in a DoS condition.


summary: A stored cross-site scripting (XSS) issue was discovered within the Custom User Icons functionality of ASUS RT-AX88U running firmware versions 3.0.0.4.388.23110 and prior. After a remote attacker logging in device with regular user privilege, the remote attacker can perform a Stored Cross-site Scripting (XSS) attack by uploading image which containing JavaScript code.

title: Asus Rt-Ax88U Firmware security vulnerability


vendor: progress

known_ransomware_campaign_use: Known

notes: This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.; https://nvd.nist.gov/vuln/detail/CVE-2023-34362

product: MOVEit Transfer

required_action: Apply updates per vendor instructions.

vendor_project: Progress

vulnerability_name: Progress MOVEit Transfer SQL Injection Vulnerability

author: Codex

content_markdown:
CVE-2023-34362 is an unauthenticated SQL injection in the HTTP/S web
application of Progress MOVEit Transfer. NVD records that the flaw can expose
the MOVEit database and, depending on whether the deployment uses MySQL,
Microsoft SQL Server, or Azure SQL, permit SQL statements that read, alter, or
delete database data. NVD scores it CVSS 3.1 9.8 critical.

This is not a patch-only event. CISA added the CVE to the Known Exploited
Vulnerabilities catalog on June 2, 2023 (required action due June 23, 2023)
and currently records known ransomware campaign use. Rechecked against that
CISA KEV JSON entry on 2026-08-21. Its joint advisory with the FBI says
CL0P began exploiting the previously unknown flaw by May 27, installed the
LEMURLOOT web shell on internet-facing MOVEit systems, and stole data. We must
therefore separate two questions: whether the installed release is fixed, and
whether an exposed system was already compromised before it was fixed.

I reviewed the public Progress advisory, release notes, patch FAQ, CISA KEV
entry and incident advisory, and the NVD record. I did not inspect MOVEit's
proprietary source, execute an exploit, or test a live appliance. This recipe
does not assert undocumented endpoint or query details and intentionally
contains no exploit payload.

## Affected versions and fixed release trains

Progress release notes identify these original CVE-specific hotfix floors:

| MOVEit Transfer train | Affected CVE-2023-34362 releases | Initial CVE-specific fix |
| --- | --- | --- |
| 2023.0 / 15.0 | 2023.0.0 | 2023.0.1 / 15.0.1 |
| 2022.1 / 14.1 | Earlier than 2022.1.5 | 2022.1.5 / 14.1.5 |
| 2022.0 / 14.0 | Earlier than 2022.0.4 | 2022.0.4 / 14.0.4 |
| 2021.1 / 13.1 | Earlier than 2021.1.4 | 2021.1.4 / 13.1.4 |
| 2021.0 / 13.0 | Earlier than 2021.0.6 | 2021.0.6 / 13.0.6 |
| 2020.1 / 12.1 | Earlier than 2020.1.6 | Progress documented a 2020.1.6 hotfix; confirm the currently supported package and upgrade path with Progress Support |
| 2020.0 / 12.0 and older | All releases, including unsupported versions | No durable legacy destination; upgrade to a supported release through a Progress-approved path |

These versions are historical minimums for CVE-2023-34362, not recommended
new deployment targets. Progress disclosed separate MOVEit SQL injection
vulnerabilities in June 2023 and subsequently directed customers to later
patches and service packs. For remediation now, install the latest cumulative,
vendor-supported release available for the approved upgrade path. Do not stop
at an initial May 31 hotfix merely because a scanner clears this one CVE.

MOVEit Cloud was patched by Progress. Cloud customers should verify the
provider notice and review tenant audit evidence; they should not attempt an
on-premises installer change.

Evidence note: NVD prose and Progress release notes name the initial
fixes above. Live NVD Transfer CPE excludes **2021.0.7 / 2021.1.5 /
2022.0.5 / 2022.1.6 / 2023.0.2**. Those are one hotfix later than
vendor **2021.0.6 / 2021.1.4 / 2022.0.4 / 2022.1.5 / 2023.0.1**.
Live GHAD `GHSA-hq22-q5g8-577g` has **vulnerabilities empty**. Do
not invent a first_patched from that empty list. Do not resolve the
NVD-versus-vendor split with a scanner suppression. Record the exact
build, the current Progress-supported release, the scanner
observation, and the vendor evidence in `TRIAGE.md`; a current
cumulative Progress release avoids relying on either historical
boundary.

## Indicator of exposure

A vulnerable installation is not automatically a reachable installation. The
known vulnerable path is the MOVEit Transfer web application over HTTP or
HTTPS. Exposure requires all of the following:

- MOVEit Transfer is in an affected train or its exact build cannot be proven.
- HTTP/S reached the MOVEit web application through IIS, a reverse proxy, a
  load balancer, a WAF, a VPN, or an internal network during the vulnerable
  period.
- The source network included an untrusted actor, compromised partner, or
  compromised internal host.

An SFTP- or FTPS-only path does not itself establish reachability to this web
flaw, but it does not make the installed release safe. Keep HTTP/S closed until
the application is patched and the exposure decision is documented. Current
isolation also does not erase earlier internet or partner exposure.

Read-only Windows inventory can start with the installed-product records:

```powershell
$uninstall = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty -Path $uninstall -ErrorAction SilentlyContinue |
  Where-Object DisplayName -Match '^MOVEit Transfer' |
  Select-Object DisplayName, DisplayVersion, InstallDate, InstallLocation
```

Corroborate that result with the MOVEit administration UI, installer history,
node inventory, and Progress release notes. Do not infer a safe version from a
file timestamp or from only one node of a web farm.

## Compromise indicators and assessment

CISA's MOVEit incident advisory describes LEMURLOOT activity and provides the
maintained IOC set and defensive YARA material. High-signal observations
include:

- an unexpected `human2.aspx` file or associated compiled ASP.NET artifact;
- HTTP telemetry containing `X-siLock-Comment` or `X-siLock-Step*` header
  names, when the logging stack captured request headers;
- an unexpected privileged account represented as `Health Check Service`;
- unexplained account creation or deletion, large or unusual downloads,
  access to dormant tenants, or database changes during the exposure window;
- CISA-listed file hashes or network indicators in EDR, proxy, WAF, IIS, or
  SIEM data.

Search the actual configured web root and log locations. Do not assume every
installation uses a default path. The following shape is read-only after an
operator supplies those paths:

```powershell
$moveitWebRoot = '<configured MOVEit web root>'
$iisLogRoot = '<configured IIS log root>'

Get-ChildItem -LiteralPath $moveitWebRoot -Filter 'human2.aspx' -Recurse -Force |
  Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc

Get-ChildItem -LiteralPath $iisLogRoot -Filter '*.log' -Recurse -File |
  Select-String -Pattern 'human2\.aspx|X-siLock-Comment|X-siLock-Step'
```

Absence of those strings is not proof of no compromise: the artifact may have
been renamed or removed, headers may not have been logged, and logs may have
expired. A version upgrade also does not remove persistence, restore altered
data, or determine what was exfiltrated.

## Emergency containment

When an affected or unknown build is reachable over HTTP/S:

1. Have the authorized network or service owner block inbound HTTP and HTTPS
   to MOVEit at the closest reliable control point. Record the exact time,
   rule, scope, owner, and business impact. Do not let an autonomous agent make
   this production change.
2. Preserve IIS, WAF, proxy, MOVEit audit, Windows event, EDR, database, and
   authentication logs. Preserve relevant file metadata and take
   organization-approved snapshots before deleting or modifying artifacts.
3. Notify the incident-response owner. If an IOC is present, exposure history
   is unclear, or logs do not cover the vulnerable window, treat the system as
   potentially compromised and follow the organization's evidence, legal,
   privacy, customer-notification, and regulatory process.
4. Obtain the signed patch or supported installer only through Progress.
   Patch every active, passive, web-farm, disaster-recovery, and golden-image
   copy before HTTP/S is restored.
5. Let incident response decide rebuild, artifact removal, account disablement,
   and credential or key rotation after evidence is preserved. Patching and
   incident eradication are separate workstreams.

## Remediation strategy

The safest default is a cumulative upgrade, not a hand-authored SQL filter or
WAF signature:

1. Inventory the exact MOVEit edition, marketing version, internal build,
   deployment role, web root, database engine, and network reachability for
   every node.
2. Resolve the approved upgrade path and latest supported cumulative release
   from Progress. Older or unsupported trains require Progress Support and may
   require an intermediate upgrade.
3. Back up configuration and database state using the organization's normal
   MOVEit recovery process. Preserve separate forensic evidence if compromise
   is suspected; do not overwrite it with an operational backup.
4. Validate the vendor package's signature or published integrity evidence,
   rehearse the upgrade and rollback in a representative non-production
   environment, and review compatibility for web farms, integrations, APIs,
   automation, certificates, and database drivers.
5. Apply the update to every node under an operator-approved maintenance plan.
   Keep vulnerable nodes and stale images out of rotation.
6. Verify the running build on each node, refresh inventory and scanner
   evidence, run normal authenticated service health checks, and obtain the IR
   owner's approval before restoring external HTTP/S access.

Do not attempt to patch MOVEit's proprietary application code in a repository.
Infrastructure-as-code changes may stage isolation, image replacement, or
installer deployment, but a human operator must approve service interruption,
production rollout, evidence handling, and re-exposure.

## When to use

Use this recipe when an on-premises MOVEit Transfer server, web farm, passive
node, disaster-recovery image, vendor appliance, CMDB record, scanner finding,
or historical incident record may involve CVE-2023-34362. It is especially
important when HTTP/S was internet-, partner-, VPN-, or broad-internal-network
reachable at any time before the environment reached a cumulative fixed build.

Use it to join four workstreams: version inventory, emergency isolation,
vendor upgrade, and compromise assessment. Do not use it to perform exploit
validation, to declare an exposed server clean, or to combine unrelated MOVEit
vulnerabilities into an unreviewed change.

## Inputs

- CMDB and asset inventory for every MOVEit Transfer and MOVEit Cloud tenant,
  including active, passive, web-farm, DR, template, snapshot, and retired
  systems.
- Exact marketing version and internal build evidence, installer/package
  provenance, Progress entitlement, support status, upgrade path, and current
  vendor release notes.
- IIS bindings, reverse proxies, WAFs, load balancers, firewall rules, VPN and
  partner paths, DNS history, and an exposure timeline.
- Configured MOVEit web roots, application and audit logs, IIS/WAF/proxy logs,
  Windows and EDR telemetry, database audit evidence, backup history, and log
  retention limits.
- User and administrator account history, file-download and tenant-access
  records, and the current CISA IOC set.
- Maintenance window, service owner, incident-response owner, evidence
  custodian, privacy/legal contacts, backup and rollback plan, and approval
  boundaries for containment and production changes.

## Agent prompt

~~~markdown
You are remediating exactly CVE-2023-34362 in a MOVEit Transfer environment.
Produce exactly one of:

- a reviewer-ready PR/change request that prepares an approved cumulative
  Progress upgrade, inventory and safe verification; or
- `TRIAGE.md` when a stop condition applies, including not-exposed evidence,
  an owner, and the next decision required.

Do not execute an exploit, send a probe to a live service, or include a SQL or
HTTP payload. Do not claim that patching proves no compromise.

### Step 0 - Establish authority and preserve evidence

1. Identify the service owner, incident-response owner, and production-change
   approver.
2. Record the current time, host/node list, exact build evidence, HTTP/S
   exposure state, and log-retention window without changing the target.
3. If suspicious activity or an IOC is already known, stop ordinary
   remediation work and create `TRIAGE.md` for incident response before any
   cleanup or upgrade can overwrite evidence.

### Step 1 - Inventory every copy

1. Find every active, passive, web-farm, DR, image, snapshot, and template copy
   of MOVEit Transfer. Identify MOVEit Cloud separately.
2. Record marketing version, internal build, role, database engine, install
   path, web root, installer provenance, support status, and upgrade owner.
3. Map HTTP/S reachability through IIS, load balancers, WAFs, proxies, VPNs,
   partner links, and internal networks for the full vulnerable period.

### Step 2 - Classify exposure and compromise risk

- Affected/unknown build plus any untrusted HTTP/S path: emergency containment
  and compromise assessment are required.
- Affected build with proven continuous HTTP/S isolation: patch before
  reopening; retain the evidence that proves isolation.
- Current cumulative fixed build: verify every node and image, then document
  whether it was previously exposed while vulnerable.
- MOVEit Cloud: record Progress's provider patch notice and tenant-log review;
  do not prepare an on-premises installer change.

Review the current CISA IOC set, configured web roots, account history,
download/audit events, and retained HTTP/S telemetry. An incomplete or expired
log window is uncertainty, not a clean result.

### Step 3 - Prepare containment and upgrade

1. If HTTP/S is still exposed, write an operator action to block it. Do not
   change production firewall, WAF, load-balancer, or IIS state yourself.
2. Select the latest cumulative, vendor-supported release on a
   Progress-approved upgrade path. Treat the May 31 CVE-specific fixes as
   historical floors, not preferred targets.
3. Use only a Progress-supplied package and record signature or integrity
   verification. Never download a patch from an exploit site or mirror.
4. Prepare configuration/database backup, staging rehearsal, compatibility,
   maintenance, rollback, and per-node rollout steps. Keep stale nodes and
   images out of rotation.

### Step 4 - Verify safely

After an authorized operator applies the update:

1. Capture the running version/build from every node and compare it with the
   Progress release evidence selected in Step 3.
2. Confirm no vulnerable node, DR image, snapshot restoration path, or golden
   image can re-enter service.
3. Re-run the approved authenticated inventory or vulnerability scan without
   exploit mode. Do not suppress a conflicting result; attach it to triage.
4. Run the organization's ordinary authenticated upload/download and
   integration health checks using non-sensitive test data.
5. Confirm the IR owner reviewed preserved evidence and approved restoration
   of HTTP/S. A clean version check is not IR clearance.

### TRIAGE.md stop conditions

Stop and write `TRIAGE.md` when any of these is true:

- `human2.aspx`, a CISA-listed IOC, `Health Check Service`, unexplained account
  activity, unusual downloads, or another suspicious event is found;
- an affected or unknown build had untrusted HTTP/S reachability and retained
  evidence cannot bound the exposure window;
- exact build, node completeness, web-farm/DR scope, or historical exposure
  cannot be proven;
- the required Progress package, signature/integrity evidence, entitlement,
  support status, or safe upgrade path cannot be verified;
- the installed release is unsupported or needs an intermediate/major upgrade
  that exceeds the authorized change;
- production containment, service interruption, database migration, rollback,
  or evidence preservation lacks an authorized owner;
- the target is MOVEit Cloud or another provider-owned deployment;
- a scanner/vendor version-boundary conflict cannot be reconciled; or
- the repository does not control the MOVEit runtime or deployment.

`TRIAGE.md` must state the observed facts, missing evidence, affected assets,
exposure window, containment status, log-retention boundary, IOC review status,
service and IR owners, vendor case if any, and the exact decision needed. Do
not paste secrets, customer file names, personal data, full access tokens, or
unredacted forensic evidence into the repository.

### Guardrails

- No exploit payloads, public-instance scanning, active SQL testing, web-shell
  interaction, destructive database queries, or unsafe live probes.
- Do not delete suspicious files or accounts, clear logs, restart services,
  rotate credentials, rebuild hosts, or alter production network controls.
  Those actions require IR/change-owner approval after evidence preservation.
- Do not write a substitute patch for proprietary MOVEit code.
- Do not use third-party patch packages or treat a WAF signature as the fix.
- Do not declare `not compromised` from absent IOCs, a successful upgrade, or
  a passing scanner result.
- Do not claim this recipe remediates separate MOVEit CVEs. The selected
  cumulative release must be checked against all applicable Progress
  advisories in a separately reviewed scope.
~~~

## Verification - what the reviewer looks for

- Every active, passive, web-farm, DR, template, and image copy has exact build
  evidence and a named owner.
- The destination is a current Progress-supported cumulative release on a
  documented upgrade path, not merely an initial May 31 hotfix.
- Package provenance and signature/integrity verification are recorded.
- Historical and current HTTP/S exposure is documented separately from SFTP
  or FTPS availability.
- Suspicious-file, account, download, HTTP, and current CISA IOC review is
  attached or handed to IR without placing sensitive evidence in the PR.
- The rollout, backup, rollback, normal service health check, and per-node
  version verification are reproducible.
- External HTTP/S remains blocked until both patch verification and IR approval
  are complete.
- A scanner disagreement is investigated, not suppressed.

## Watch for

- **Patching is not incident response.** The campaign predates public
  disclosure. A fixed build says nothing about activity before installation.
- **Partial fleet upgrades.** Passive nodes, DR images, snapshots, and golden
  images can silently restore a vulnerable server.
- **Historical hotfix confusion.** The initial CVE-specific floors are not a
  safe reason to remain on an obsolete branch. Later Progress advisories and
  cumulative service packs matter.
- **NVD metadata differences.** NVD prose, CPE ranges, and vendor release notes
  are not perfectly aligned. Prefer a current cumulative vendor release and
  preserve disagreement for review.
- **False clean results.** Missing `human2.aspx` or missing header telemetry is
  not proof of no exploitation; artifacts and logs can be absent.
- **Evidence destruction.** Upgrade, cleanup, account deletion, log rotation,
  and rebuilds can destroy the timeline investigators need.
- **Web farm and database dependencies.** Version skew or an unreviewed schema
  change can cause outage or rollback failure.
- **Cloud ownership.** MOVEit Cloud patching is provider-operated; customer
  responsibilities are status confirmation, tenant evidence review, and any
  resulting incident actions.
- **Sensitive output.** MOVEit logs and audit data can contain customer,
  partner, file, account, and transfer details. Redact before attaching.

## Rollback

Do not roll back into NVD-listed Transfer ranges below **2021.0.7 /
2021.1.5 / 2022.0.5 / 2022.1.6 / 2023.0.2** or into vendor
**2021.0.6 / 2021.1.4 / 2022.0.4 / 2022.1.5 / 2023.0.1**. Do not
flatten leftover **2023.0.1** onto NVD **2023.0.2** and do not invent
a first_patched from the empty GHAD vulnerabilities list.

## Output contract

Return one of:

- A reviewer-ready PR/change request that inventories every MOVEit copy,
  prepares a current Progress-supported cumulative upgrade, records vendor
  package provenance, stages containment and operator actions, preserves the
  compromise-assessment handoff, verifies every running node and image, and
  documents backup, rollback, and safe service health checks.
- `TRIAGE.md` when evidence of compromise exists, exposure or logs are
  incomplete, the build or complete fleet cannot be proven, a supported
  Progress upgrade path is unavailable, operational/IR ownership is missing,
  the provider owns patching, or the repository cannot control the runtime.

The output must include asset and node inventory, before/after builds, database
engine, deployment role, HTTP/S exposure timeline, containment status,
Progress evidence and package provenance, log-retention and IOC review status,
IR and service owners, maintenance and rollback plan, per-node validation,
scanner result, and the approval required before re-exposure. It must not
contain exploit material, sensitive customer evidence, unsupported cleanliness
claims, third-party patches, or unapproved production actions.

## References

- Progress MOVEit Transfer critical vulnerability advisory:
  <https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023>
- Progress MOVEit Transfer 2023 fixed issues, including the 2023.0.1 hotfix:
  <https://docs.progress.com/bundle/moveit-transfer-release-notes-2023/page/Fixed-Issues-in-2023.html>
- Progress MOVEit Transfer 2022.1.5 fixed issues:
  <https://docs.progress.com/bundle/moveit-transfer-release-notes-2022_1/page/Fixed-Issues-in-2022.1.5.html>
- Progress MOVEit Transfer 2022.0.4 fixed issues:
  <https://docs.progress.com/bundle/moveit-transfer-release-notes-2022/page/Fixed-Issues-2022.0.4.html>
- Progress legacy MOVEit Transfer 2021 release notes:
  <https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm>
- Progress legacy MOVEit Transfer 2021.1 release notes:
  <https://docs.ipswitch.com/MOVEit/Transfer2021_1/ReleaseNotes/en/index.htm>
- Progress legacy MOVEit Transfer 2020.1 release notes:
  <https://docs.ipswitch.com/MOVEit/Transfer2020_1/ReleaseNotes/en/index.htm>
- Progress security update and mitigation statement, June 5, 2023:
  <https://www.progress.com/amp/update-steps-we-are-taking-protect-moveit-customers/dWU5d09jQTFGZndVVnJod2xERzk5TENYb204PQ2>
- Progress MOVEit Transfer and MOVEit Cloud patch FAQ:
  <https://www.progress.com/docs/default-source/moveit-docs/moveit-transfer_moveit-cloud-vulnerabilities-customer-faq_posted.pdf?sfvrsn=16a47a99_13>
- CISA Known Exploited Vulnerabilities catalog entry:
  <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362>
- FBI/CISA AA23-158A, CL0P exploitation of MOVEit Transfer:
  <https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a>
- NVD CVE-2023-34362 record:
  <https://nvd.nist.gov/vuln/detail/CVE-2023-34362>

## Related workflow

- [CVE Intelligence Intake Gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})
  - use it when a scanner row, cloud notice, affected build, or exposure claim
  is incomplete before starting remediation.
- [Vulnerable Dependency Remediation]({{< relref "/security-remediation/vulnerable-dependencies" >}})
  - use its ownership, rollout, SBOM, and review controls around this
  product-specific vendor upgrade.

description: Known-exploited MOVEit Transfer leftover. NVD CPE excludes 2023.0.2. Vendor names 2023.0.1. Prefer a current Progress-supported release.

maturity: stable

model: GPT 5.5 Extra High reasoning

title: CVE-2023-34362 - MOVEit Transfer unauthenticated SQL injection

quality: curated

recipe_kind: markdown-override

summary: In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.


summary: An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error is encountered initializing the encryption object used to encrypt data, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key. It is possible for a well-placed attacker to predict the output of this random number generator, which could lead to an attacker decrypting traffic between the driver and the database server. The vulnerability does not exist if SSL / TLS encryption is used.


summary: A buffer overflow was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. An overly large value for certain options of a connection string may overrun the buffer allocated to process the string value. This allows an attacker to execute code of their choice on an affected host by copying carefully selected data that will be executed as code.


vendor: Yifan

summary: A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability.


product: Ichitaro 2023

vendor: Ichitaro 2023

vendor: justsystems

summary: A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability.


vendor: microsoft

summary: Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devices). NOTE: The vendor considers this a low severity issue.


product: Kanban Boards for WordPress

vendor: Kanban for WordPress

status: unaffected

ecosystem: php/wordpress

vendor: kanbanwp

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kanban for WordPress Kanban Boards for WordPress plugin <= 2.5.20 versions.

title: Kanbanwp Kanban Boards security vulnerability


product: Login Configurator

vendor: GrandSlambert

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.

title: Login Configurator Project Login Configurator security vulnerability


vendor: Brainstorm Force

product: Premium Starter Templates

archetype: ssrf

status: Deferred

summary: Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Premium Starter Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4; Premium Starter Templates: from n/a through 3.2.4.

title: Brainstorm Force Starter Templates — Elementor, Wordpress & Beaver Buil… security vulnerability


product: SpamReferrerBlock

vendor: Didier Sampaolo

product: spamreferrerblock

summary: Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.


vendor: didcode

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.

title: Didcode Spamreferrerblock security vulnerability


product: Zephyr Project Manager

vendor: Dylan James

summary: Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.


product: AnsPress

vendor: Rahul Aryan

product: anspress

vendor: anspress

summary: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Rahul Aryan AnsPress plugin <= 4.3.0 versions.

title: Anspress security vulnerability


product: SEO by 10Web

product: seo

summary: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions.

title: 10Web Seo security vulnerability


vendor: Rextheme

summary: Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3.

title: Rextheme Change Woocommerce Add To Cart Button Text security vulnerability


product: My Content Management

vendor: Joseph C Dolson

vendor: joedolson

summary: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions.

title: Joedolson My Content Management security vulnerability


product: WP Hide Post

vendor: scriptburn

summary: Cross-Site Request Forgery (CSRF) vulnerability in scriptburn.Com WP Hide Post plugin <= 2.0.10 versions.


vendor: MagneticOne

vendor: magneticone

summary: Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0.

title: Magneticone Magento To Woocommerce Migration security vulnerability


product: Zippy

vendor: Gesundheit Bewegt GmbH

summary: Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.

title: Gesundheit Bewegt Gmbh Zippy security vulnerability


vendor: weDevs

product: dokan

vendor: dokan

summary: Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.

title: Dokan security vulnerability


product: WP Project Manager

vendor: wedevs

summary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.

title: Wedevs Wp Project Manager security vulnerability


product: Kebo Twitter Feed

vendor: Kebo

summary: Cross-Site Request Forgery (CSRF) vulnerability in Kebo Kebo Twitter Feed plugin <= 1.5.12 versions.


product: Export Import Menus

vendor: Akshay Menariya

vendor: akshaymenariya

summary: Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0.

title: Akshaymenariya Export Import Menus security vulnerability


product: WPC Smart Wishlist for WooCommerce

vendor: WPClever

vendor: wpclever

summary: Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.


product: Constant Contact Forms

vendor: Constant Contact

summary: Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.

title: Constant Contact Constant Contact Forms security vulnerability


vendor: Schweitzer Engineering Laboratories

vendor: selinc

summary: An Improper Authentication vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote unauthenticated attacker to potentially perform session hijacking attack and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more details.

title: Selinc Sel-451 Firmware security vulnerability


summary: An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to make the system unavailable for an indefinite amount of time. See product Instruction Manual Appendix A dated 20230830 for more details.


summary: An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service against the system and locking out services. See product Instruction Manual Appendix A dated 20230830 for more details.


product: SEL-5033 AcSELerator RTAC Software

summary: Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230522 for more details. This issue affects SEL-5033 AcSELerator RTAC Software: before 1.35.151.21000.

title: Selinc Sel-5033 Acselerator Real-Time Automation Controller security vulnerability


product: SEL-5037 SEL Grid Configurator

summary: A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.

title: Selinc Sel-5037 Sel Grid Configurator security vulnerability


product: N6845A Geolocation Server

vendor: Keysight Technologies

vendor: keysight

summary: In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition.

title: Keysight Geolocation Server security vulnerability


product: Apache Airflow ODBC Provider

vendor: Apache Software Foundation

product: apache-airflow-providers-odbc

vendor: apache

summary: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.

title: Apache Apache-Airflow-Providers-Odbc security vulnerability


product: Apache Struts

product: struts

summary: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

title: Apache Struts security vulnerability


vendor: mercedes-benz

summary: Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can trigger that the service will be crashed.


summary: Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The boost library contains a vulnerability/null pointer dereference.


summary: Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.


summary: Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the file and convert it to null-terminated string. If character is missed, will return null pointer.


summary: Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsulate another file, which service will drop during processing. Due to missed checks, attacker can achieve Arbitrary File Write with service speech rights.


summary: Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins and get access to internal network. A race condition can be acquired and attacker can spoof “UserData” with desirable file path and access it though backup on USB.


summary: Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to internal network. As a result, by accessing a specific port an attacker can send call request to all registered services in router and achieve command injection vulnerability.


vendor: harbingergroup

summary: OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL.


product: dokuwiki

vendor: dokuwiki

summary: DokuWiki before 2023-04-04a allows XSS via RSS titles.


vendor: percona

summary: In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.

title: Percona Monitoring And Management security vulnerability


vendor: debian

product: fedora

vendor: fedoraproject

product: qt

vendor: qt

summary: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.


archetype: xxe

summary: The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.


product: mbNET

vendor: Red Lion Europe

product: REX 200

vendor: Helmholz

product: REX 250

vendor: helmholz

vendor: redlion

summary: A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).

title: Helmholz Rex 250 Firmware security vulnerability


product: Firefox

vendor: Mozilla

ecosystem: browser

product: firefox

vendor: mozilla

summary: When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.

title: Mozilla Firefox security vulnerability


product: Firefox ESR

product: Thunderbird

product: thunderbird

summary: Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12.


summary: Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 114.


product: Lenovo XClarity Administrator

vendor: Lenovo

version: Versions prior to 4.0

vendor: lenovo

summary: A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.

title: Lenovo Xclarity Administrator security vulnerability


product: Lenovo Notebook

version: various

summary: A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

title: Lenovo Legion 5 Pro 16Iah7H Firmware security vulnerability


summary: A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.


summary: A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.


summary: A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.


product: Survey Maker

vendor: AYS Pro Plugins

version: prior to 3.6.4

vendor: ays-pro

summary: Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product with the administrative privilege.


product: Intel(R) CSME

summary: Improper input validation in firmware for some Intel(R) CSME may allow a privileged user to potentially enable denial of service via local access.

title: Intel(R) Csme security vulnerability


product: iOS and iPadOS

vendor: Apple

product: macOS

product: watchOS

product: ipados

vendor: apple

product: macos

product: watchos

summary: The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.


vendor: Yifan

vendor: yifanwireless

summary: A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability.


version: version 0.25.0

vendor: intel

summary: Protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Realsense 450 Fa Firmware security vulnerability


product: Weincloud

vendor: Weintek

product: weincloud

vendor: weintek

summary: Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.


version: before version 2.2.1

summary: Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel Battery Life Diagnostic Tool security vulnerability


product: Intel(R) Server Board BIOS firmware

summary: Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access

title: Intel Server Board M70Klp2Sb Firmware security vulnerability


product: sox

product: Fedora

vendor: Fedora

product: Extra Packages for Enterprise Linux

vendor: fedoraproject

product: fedora

vendor: redhat

summary: A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.


product: M-Bus SoftwarePack

vendor: PiiGAB

vendor: piigab

summary: PiiGAB M-Bus stores passwords using a weak hash algorithm.


product: Apache InLong

vendor: Apache Software Foundation

product: inlong

vendor: apache

summary: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .

title: Apache Inlong security vulnerability


vendor: LevelOne

product: rtl819x Jungle SDK

vendor: Realtek

vendor: realtek

summary: A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted network packets can lead to arbitrary firmware update. An attacker can provide a malicious file to trigger this vulnerability.


product: GTKWave

vendor: GTKWave

product: gtkwave

vendor: tonybybell

summary: An out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.


product: Bently Nevada 3500 System

vendor: Baker Hughes - Bently Nevada

vendor: bakerhughes

summary: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.

title: Bakerhughes Bentley Nevada 3500 System Firmware security vulnerability


product: Intel(R) NUC BIOS firmware

vendor: intel

summary: Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel Nuc Rugged Kit Nuc8Cchb Firmware security vulnerability


product: Pleasanter

vendor: Implem Inc.

version: 1.3.47.0 and earlier

product: pleasanter

vendor: pleasanter

summary: Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.


product: Intel(R) Processors

summary: Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

title: Intel(R) Processors security vulnerability


summary: Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.


product: iTop

vendor: Combodo

product: itop

vendor: combodo

summary: Combodo iTop is a simple, web based IT Service Management tool. When displaying page Run queries Cross-site Scripting (XSS) are possible for scripts outside of script tags. This has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.


summary: Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.searchform.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.


summary: Combodo iTop is a simple, web based IT Service Management tool. When displaying pages/ajax.render.php XSS are possible for scripts outside of script tags. This issue has been fixed in versions 2.7.9, 3.0.4, 3.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.


summary: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, when displaying `pages/preferences.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.


summary: iTop is an open source, web-based IT service management platform. Prior to versions 3.0.4 and 3.1.0, on `pages/UI.php`, cross site scripting is possible. This issue is fixed in versions 3.0.4 and 3.1.0.