Strike Database
Important Information
On August 12th, 2022, many of Keysight’s Network Test, Network Visibility, & Edge to Core (NAS/formerly Ixia) products will migrate to a new license structure.
CRITICAL: If you perform licensing operations after August 12th, 2022, without upgrading the licensing software to the latest version, licenses may not register properly, and some features may be missing. This could impact testing and result in downtime.
For details, click here.
Displaying 141 - 160 of 148036
CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
This strike exploits a resource exhaustion vulnerability in Novell Open Enterprise. When a TCP connection to the HTTPSTK service is terminated using a FIN packet, SSL_free is not called, causing the connection to remain in the CLOSE_WAIT state. An attacker can connect and terminate many connections, eventually exhausting the system resources, resulting in a denial of service condition.
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
This strike exploits an information disclosure vulnerability in Apache Camel. XML entities with PUBLIC or SYSTEM identifiers are processed and returned. An attacker can craft a SYSTEM entity to return information on system information or a PUBLIC entity to send requests from the Camel server, possibly allowing for policy bypass.
CVSS: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in Microsoft Internet Explorer. If a DOMNodeRemoved event is triggered and all the objects that belong to the current HTMLSelection object are removed inside the event handler for DOMNodeRemoved, a use-after-free condition can occur.
CVSS: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
This strike exploits a vulnerability in the Linux kernel. The target network interface card must support UDP Fragmentation offload to be vulnerable to this attack. By issuing a TFTP request over IPv6 with a blocksize larger than the MTU, the TFTP daemon on the vulnerable server will send a large packet resulting in a kernel panic, causing a denial of service condition.
CVSS: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
This strike replicates a remote code execution attack on Elastic Kibana, through a JavaScript prototype pollution vector. The vulnerability is due to lack of sanitization for user supplied data when parsing Timelion component requests. By exploiting this flaw, a remote unauthenticated attacker might execute arbitrary code on the target system.
CVSS: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
A denial-of-service vulnerability exists in VxWorks' TCP stack, for Wind River VxWorks versions 6.6 through vx7. Whenever a TCP packet with malformed options is received, the SEQ and ACK numbers are not being checked, and a RST on the connection is immediately issued. By spoofing the source IP address and bruteforcing the source port number space (1024 through 65535), an attacker may send...
CVSS: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
This strike exploits a command injection vulnerability in the Exhibitor Web UI. The vulnerability is due to improper parsing of parameters passed to the config editor web form. A malicious attacker can exploit this by performing a specially-crafted HTTP request. Successful exploitation leads to arbitrary commands being run in the context of the user running the Exhibitor server.
CVSS: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
This strike exploits a use-after-free vulnerability in the Excel component of Microsoft Office. The vulnerability is due to improper handling of XML elements by the 'MSO.DLL' library. The vulnerability can be exploited by crafting a malicious XML file and enticing a user to download and open it. Successful exploitation may result in execution of arbitrary code with user privileges.
CVSS: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
This strike exploits a use after free vulnerability in the Microsoft Windows Imaging API component of Microsoft Windows. The vulnerability is due to improper handling of WIM records in memory by the 'wimgapi.dll' library. The vulnerability can be exploited by crafting a malicious WIM image file and enticing a user to download and mount it. Successful exploitation may result in execution of...
CVSS: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
This strike exploits a vulnerability in the Microsoft Edge browser. Specifically the vulnerability exists within the Javascript Chakra engine. An attacker can craft Javascript in such a way that when the AppendLeftOverItemsFromEndSegment method is invoked an out of bounds memory read will occur. This can lead to a denial of service condition in the browser or potentially remote code execution....
CVSS: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in the Microsoft Internet Explorer browser. Specifically the vulnerability exists within the Javascript engine. An attacker can craft Javascript in such a way that when invoking the lastIndexOf method on String a Use After Free can occur potentially resulting in memory disclosure. This can lead to a denial of service condition in the browser or potentially remote...
CVSS: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
This strike exploits a vulnerability in the Google Chrome browser. Specifically the vulnerability exists within the Javascript V8 engine. An attacker can craft Javascript in such a way that the AwaitedPromise method can be replaced with user Javascript through the use of a then getter. This may lead to an incorrect state in the generator, which can lead to a denial of service condition in the browser...
CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
This strike exploits a reflected cross-site scripting vulnerability found in OpenProject Web interface. This vulnerability is due to inadequate input filtering in the web interface, while parsing input passed to 'sortBy' parameter within 'projects' page. By exploiting this vulnerability an attacker could cause arbitrary HTML/script code to be executed by the target user's...
CVSS: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
This strike exploits a heap buffer overflow vulnerability in the 'mod_remoteip' component of Apache httpd. The vulnerability is due to improper processing of data in the PROXY protocol. Successful exploitation could lead to remote code execution with the privileges of the user running the httpd
CVSS: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
This strike exploits a remote code execution in Apache Solr via Velocity template in the VelocityResponseWriter plugin. When params resource loader is set to true, the user will be allowed to specify the loading of related resources by setting the parameters in the request, this allows the attacker to construct a threatening request on the server. Successful exploitation will result in code execution...
CVSS: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
A command injection vulnerability exists in the rConfig network device configuration management tool. The vulnerability is due to insufficient input validation in the 'ajaxServerSettingsChk.php' module. A remote, unauthenticated attacker can create a malicious HTTP request resulting in arbitrary command execution on the target system with the privileges of the user running the web server...
CVSS: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in the Microsoft Edge browser. Specifically the vulnerability exists within the Javascript Chakra engine. An attacker can craft Javascript in such a way that SetConcatStrMultiItemBE instructions can be hoisted without properly validating its type. This causes type confusion to occur, and can lead to a denial of service condition in the browser or potentially...
CVSS: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
This strike exploits a double-free vulnerability in the Microsoft Edge browser. The vulnerability lies within the rendering component. It is possible to partially initialize canvas pattern objects and trigger a double-free. This may lead to arbitrary read-write in the browser or potentially remote code execution.
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
This strike exploits an insecure Java deserialization vulnerability in Cisco Security Manager. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary...
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
A buffer underflow vulnerability exists in PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11. The vulnerability resides in 'init_request_info (fpm_main.c)' function and is a side-effect of no string length check when FCGI parameters are received from a nginx server. An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on the target...
