Strike Database
Important Information
On August 12th, 2022, many of Keysight’s Network Test, Network Visibility, & Edge to Core (NAS/formerly Ixia) products will migrate to a new license structure.
CRITICAL: If you perform licensing operations after August 12th, 2022, without upgrading the licensing software to the latest version, licenses may not register properly, and some features may be missing. This could impact testing and result in downtime.
For details, click here.
Displaying 141 - 160 of 58316
CVSS: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
A command injection vulnerability exists in the rConfig network device configuration management tool. The vulnerability is due to insufficient input validation in the ajaxServerSettingsChk.php module. A remote, unauthenticated attacker can create a malicious HTTP request resulting in arbitrary command execution on the target system with the privileges of the user running the web server.
CVSS: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
This strike exploits a heap buffer overflow vulnerability in the mod remoteip component of Apache httpd. The vulnerability is due to improper processing of data in the PROXY protocol. Successful exploitation could lead to remote code execution with the privileges of the user running the httpd
CVSS: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in the Microsoft Internet Explorer browser. Specifically the vulnerability exists within the Javascript engine. An attacker can craft Javascript in such a way that when invoking the lastIndexOf method on String a Use-After-Free can occur potentially resulting in memory disclosure. This can lead to a denial of service condition in the browser or potentially remote...
CVSS: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
This strike exploits a vulnerability in the Microsoft Edge browser. Specifically the vulnerability exists within the Javascript Chakra engine. An attacker can craft Javascript in such a way that when the AppendLeftOverItemsFromEndSegment method is invoked an out of bounds memory read will occur. This can lead to a denial of service condition in the browser or potentially remote code execution....
CVSS: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
This strike exploits a double-free vulnerability in the Microsoft Edge browser. The vulnerability lies within the rendering component. It is possible to partially initialize canvas pattern objects and trigger a double-free. This may lead to arbitrary read-write in the browser or potentially remote code execution.
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
This strike exploits an insecure Java deserialization vulnerability in Cisco Security Manager. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary...
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
A buffer underflow vulnerability exists in PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11. The vulnerability resides in init request info fpm main.c function and is a side-effect of no string length check when FCGI parameters are received from a nginx server. An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on the target server.
CVSS: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in the Microsoft Edge browser. Specifically the vulnerability exists within the Javascript Chakra engine. An attacker can craft Javascript in such a way that SetConcatStrMultiItemBE instructions can be hoisted without properly validating its type. This causes type confusion to occur, and can lead to a denial of service condition in the browser or potentially...
CVSS: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
This strike exploits a vulnerability in the Apple Safari browser. Specifically the vulnerability exists when compiling WebAssembly source buffers in WebKit. The source buffer is copied to a read only buffer, and if this buffer is a view, the offset is added to the buffer which can potentially allow for heap memory to be read off of the source. This can result in a denial of service condition in the...
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
This strike exploits a file upload vulnerability in the Wordpress Plugin MailPoet Newsletters. The vulnerability allows for the unauthenticated attacker to take advantage of the plugins use of the admin init hook by uploading a theme using wp-admin/admin-post.php. By exploiting this vulnerability, an unauthenticated attacker can upload arbitrary files on the server and execute them.
CVSS: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
A logic error exists in ProFTPD 1.3.6rc2, resulting in infinite loops getting triggered by commands with 4100 or more characters. An unauthenticated, remote attacker can exploit this vulnerability by sending an excessively long command to the target server. Successful exploitation causes an infinite loop leading to full CPU usage.
CVSS: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
This strike exploits a command injection vulnerability in the WebUI component of Cisco IOS XE. The vulnerability is due to improper validation of user-supplied snortcheck.lua form data via the WebUI. An user with low privilege access can exploit this vulnerability by sending a crafted HTTP request to the target server. Successful exploitation results in execution of Cisco console commands with...
CVSS: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
An out-of-bounds read vulnerability exists in several Adobe Acrobat products containing the acrodistdll.dll shared library. The OOB read occurs whenever comments placed inside postscript objects are processed and no new line character is further detected. A remote attacker could exploit this vulnerability by enticing a user to open a maliciously crafted JOBOPTIONS file. Successful exploitation of...
CVSS: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
This strike exploits a vulnerability in the Microsoft Edge browser. Specifically the vulnerability exists within the Javascript Chakra engine. An attacker can craft Javascript in such a way that the CopyFrom method does not copy all fields, including the IsShadowed field, from another descriptor to this. This causes type confusion to occur, and can lead to a denial of service condition in the browser...
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
A server-side template injection vulnerability that leads to remote code execution exists in vBulletin versions 5.0.0 up to 5.5.4. By exploiting it, a remote unauthenticated attacker may execute arbitrary code using servers PHP engine.
CVSS: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
This strike simulates an OS command injection attack via a CSRF present in ASUS RT-N10+, with firmware version 2.0.3.4 By enticing an administrator user to open a crafted attachment or by performing a WIFI attack such as EvilTwin, an attacker may execute arbitrary command on the target device.
CVSS: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
This strike exploits a command injection vulnerability in the WebUI component of Cisco IOS XE. The vulnerability is due to improper validation of user-supplied form data via the WebUI. An user with low privilege access can exploit this vulnerability by sending a crafted HTTP request to the target server. Successful exploitation results in the execution of Cisco console commands with administrative...
CVSS: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
A heap-based buffer overflow exists in Exim versions 4.92 to 4.92.2 due to lack of user input sanitization when processing EHLO commands. A successful attack may lead to remote command execution with the privileges of the user running the Exim service.
CVSS: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
A remote OS command injection exists in multiple devices using the Shenzhen TVT Digital Technology API. Due to hardcoded credentials and lack of input sanitization when parsing user supplied data, the vulnerability allows remote attackers to execute arbitrary OS commands with root privileges.
CVSS: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
This strike exploits a remote code execution vulnerability in the Graphics Device Interface module of Microsoft Windows. The vulnerability is due to improper handling of EMF records in memory within the GDI32.dll module. The vulnerability can be exploited by crafting a malicious EMF file and enticing a user to download and open it. Successful exploitation may result in disclosure of sensible...
