Strike Database
Important Information
On August 12th, 2022, many of Keysight’s Network Test, Network Visibility, & Edge to Core (NAS/formerly Ixia) products will migrate to a new license structure.
CRITICAL: If you perform licensing operations after August 12th, 2022, without upgrading the licensing software to the latest version, licenses may not register properly, and some features may be missing. This could impact testing and result in downtime.
For details, click here.
Displaying 121 - 140 of 148036
CVSS: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
A remote command injection vulnerability exists in OpenSMTPD after commit a8e222352f and before version 6.6.2. The vulnerability is due to lack of user input sanitization when processing 'MAIL FROM' commands. A successful attack may lead to remote command execution with the privileges of the user running the OpenSMTPD service.
CVSS: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
This strike exploits a vulnerability in Apple Webkit. Specifically, an attacker can cause an integer overflow in NodeRareData::m_connectedFrameCount by inserting a large number of iframe elements into a DOM node that already has cached subframes. Doing this can cause type confusion to occur leading to a denial of service in the browser, and it can also lead to a UXSS attack.
CVSS: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
This strike exploits a vulnerability in Spidermonkey, the Javascript engine of Mozilla Firefox. The issue is caused by incorrect alias information for Array.prototype.slice method within IonMonkey JIT compiler component. This can lead to a denial of service or potentially allow for remote code execution to occur.
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
An integer overflow vulnerability exists in 'parse_mqtt' (mongoose.c) in Cesanta Mongoose 6.16. By sending a crafted packet, a remote unauthenticated attacker may lead the server into a infinite loop, causing DoS conditions.
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
An OS command injection vulnerability exists in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. The command injection is possible using a directory traversal flaw, due to improper sanitization of multiple fields in HTTP requests. The flaw may be exploited by an unauthenticated attacker to execute arbitrary commands on the target server.
CVSS: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
This strike exploits a vulnerability in Apple Webkit JavaScriptCore. Specifically, a Use After Free occurs when the jsElementScrollHeightGetter function is invoked in a specific manner. When this happens a denial of service condition, or potentially remote code execution, may occur.
CVSS: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
A denial-of-service flaw exists in Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4. An authenticated attacker may crash the service by sending a crafted X-Reason HTTP header containing an Erlang format string which causes the server to allocate a massive memory region....
CVSS: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
This strike exploits an information disclosure vulnerability in Microsoft SharePoint. This vulnerability is due to insufficient validation of uploaded files. A remote, authenticated attacker could exploit this vulnerability by uploading a maliciously crafted file to a target SharePoint server. Successful exploitation of this vulnerability allows the attacker to disclose NTLM hashes, which in turn...
CVSS: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
This strike exploits a heap double free vulnerability found in Adobe Acrobat and Reader. The vulnerability is due to improper input validation while parsing specific header fields of a PDF document. An attacker could exploit this vulnerability by creating a specially crafted PDF file and entice a user to open it. Successful exploitation could lead to arbitrary code execution on the target machine...
CVSS: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
A command injection vulnerability exists in OpenEMR 5.0.1 and earlier, within 'scanned_notes/new.php' form file, as a result of weak user input sanitization. By sending a crafted 'id' parameter in a HTTP request, a remote authenticated attacker might execute arbitrary system commands.
CVSS: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
This strike exploits a heap buffer overflow vulnerability in MF3216 component of Microsoft Windows. The vulnerability is due to improper handling of EMF records. An attacker could gain arbitrary code execution by enticing the user to open and save a malicious EMF or RTF file.
CVSS: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
An insecure deserialization vulnerability was found in Oracle WebLogic Server. The vulnerability is due to insufficient validation of serialized data within T3 requests. The vulnerability can be exploited by sending a specially crafted serialized object. Successful exploitation can result in arbitrary code execution within the context of the user running WebLogic.
CVSS: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in the Microsoft Internet Explorer scripting engine. Specifically, an attacker can craft an HTML page containing a Javascript script in such a way that a call to 'jscript!JSONStringifyObject()' frees an object that is later going to be referred by 'jscript!PrepareInvoke()', resulting in a use-after-free condition. A remote attacker could...
CVSS: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
This strike exploits an Out of Bounds Write vulnerability in Microsoft Jet Database Engine. The vulnerability is due to improper handling of objects in memory. The user would be enticed to visit a site or open a web page, causing arbitrary code to be executed.
CVSS: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
A SQL injection vulnerability exists in the 'Work in Progress' component of Oracle E-Business Suite. A SQL query may be bundled in a FndMessageRequest object sent via the 'Thin Client Framework' protocol over HTTP, which is later processed in the 'public Vector fetchMessages' method located in 'oracle/apps/wip/gantt/components/server/database/MessageFetcher.class...
CVSS: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
A SQL injection vulnerability exists in the 'General Ledger' component of Oracle E-Business Suite. A SQL query may be sent via the 'Thin Client Framework' protocol over HTTP, which is later processed in the 'DataManagerServer.readSynch()' method located in 'oracle/apps/gl/jahe/tcf/server/DataManagerServer.java'. The string is then used as a base string for a...
CVSS: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
This strike exploits a Use After Free vulnerability on Adobe Flash Player. The vulnerability can be triggered due to inadequate memory management when using a SharedObject entities. A user could be manipulated into accessing a web page that downloads and executes a malicious file that can lead to arbitrary code execution with local user privileges. All versions of flash player below 12.0.0.44 and 11....
CVSS: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
This strike exploits a stack buffer overflow vulnerability in PostgreSQL. If IntervalStyle is set to postgres_verbose, a fixed buffer is used when processing the output string. A specially crafted SQL INTERVAL command can be used to overflow this buffer. Successful exploitation may result in execution of arbitrary code or abnormal termination of PostgreSQL, leading to a denial of service condition...
CVSS: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
This strike identifies a vulnerability in Samsung DVR Firmware v1.10. An authentication bypass is possible because of improper validation of CGI page requests. If an HTTP request is made to one of many URI paths with a malicious cookie value set, then access will be given to the attacker with the ability to perform many functions such as read usernames and passwords, create users, and read and modify...
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
This strike exploits a Java code execution vulnerability in Apache Camel. An attacker can make an HTTP request with a CamelXsltResourceUri pointing to a malicious XSL file containing arbitrary Java code. The server will download the XSL file and execute the code.
