Write-ups

CVE Highlights

10.0(critical)
2025-07-17
Cisco Identity Services Engine
invokeStrongSwanShellScript Command Injection Remote Code Execution
Execute code in the context of root.
CVE-2025-20281ZDI-25-609
Write-up ↗: CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability NVD ↗
9.9(critical)
UPCOMING
Oracle
Details published once the vendor ships a fix.
ZDI-CAN-32013reported 2026-06-23overdue
9.3(critical)
2026-06-24
Oracle PeopleSoft
HttpListeningConnector Server-Side Request Forgery
Execute arbitrary code in the context of the service account.
CVE-2026-35273ZDI-26-387
Write-up ↗: CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft NVD ↗
7.8(high)
2024-05-19
Adobe Acrobat Reader DC
PDF File Parsing Out-Of-Bounds Write Remote Code Execution
Execute code in the context of the current process.
CVE-2024-30310ZDI-24-483
NVD ↗

Advisories

/

status

cvss

vendor

47 published · 15 upcoming · 14 vendors

Upcoming15

Reported to the vendor and awaiting a fix. ZDI publishes the details once the vendor ships one.

0x3b9.9 (critical)
Oracle
9.9 (critical)ZDI-CAN-32013reported 2026-06-23
overdue
7 days past the vendor deadline. due 2026-10-21
0x3d8.1 (high)
MailEnable
8.1 (high)ZDI-CAN-34489reported 2026-09-25
D−87
87 days until the vendor deadline. due 2027-01-23
0x2f7.8 (high)
npm
7.8 (high)ZDI-CAN-29171reported 2026-02-05with Michael DePlante
overdue
145 days past the vendor deadline. due 2026-06-05
0x307.8 (high)
npm
7.8 (high)ZDI-CAN-29187reported 2026-02-05with Michael DePlante
overdue
145 days past the vendor deadline. due 2026-06-05
0x317.8 (high)
Cisco
7.8 (high)ZDI-CAN-29198reported 2026-02-12
overdue
138 days past the vendor deadline. due 2026-06-12

Published47

0x2e7.5 (high)
Cisco Identity Services Engine
Missing Authentication for Critical Function Information Disclosure
7.5 (high)CVE-2026-20190ZDI-26-580
2026-08-13
Disclose stored credentials, leading to further compromise.
flaw in
the handling of upgrade files
caused by
the lack of authentication prior to allowing access to functionality
NVD ↗
attack vector
network
complexity
low
privs required
none
user interaction
none
scope
unchanged
confidentiality
high
integrity
none
availability
none
reportedpublished
2026-02-122026-08-13
182 days to disclosure
0x2d7.2 (high)
Heimdall Data Database Proxy
generateFileContent CRLF Injection Remote Code Execution
7.2 (high)CVE-2026-12357ZDI-26-447
2026-07-23
Execute code in the context of root.
flaw in
the generateFileContent function
caused by
the lack of proper neutralization of CRLF sequences
NVD ↗
attack vector
network
complexity
low
privs required
high
user interaction
none
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2026-02-122026-07-23
161 days to disclosure
0x2c7.5 (high)
Oracle PeopleSoft
HubMBeanPersistance Deserialization of Untrusted Data Remote Code Execution
7.5 (high)CVE-2026-35273ZDI-26-388with Minh Giang, Lucas Miller
2026-06-24
Execute code in the context of the service account.
flaw in
the HubMBeanPersistance method
caused by
the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data
NVD ↗
attack vector
network
complexity
high
privs required
low
user interaction
none
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2026-06-102026-06-24
14 days to disclosure
0x2b9.3 (critical)
Oracle PeopleSoft
HttpListeningConnector Server-Side Request Forgery
9.3 (critical)CVE-2026-35273ZDI-26-387with Minh Giang, Lucas Millerwrite-up
2026-06-24
Execute arbitrary code in the context of the service account.
flaw in
the HttpListeningConnector class
caused by
the lack of proper validation of a URI prior to accessing resources
Write-up ↗: CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft NVD ↗
attack vector
network
complexity
low
privs required
none
user interaction
none
scope
changed
confidentiality
high
integrity
low
availability
none
reportedpublished
2026-06-102026-06-24
14 days to disclosure
0x2a8.8 (high)
Quest NetVault Backup
viewclient Cross-Site Scripting Authentication Bypass
8.8 (high)CVE-2026-7569ZDI-26-377
2026-06-24
Execute arbitrary code in the context of SYSTEM.
flaw in
the viewclient webpage
caused by
the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
network
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2025-10-032026-06-24
264 days to disclosure
0x294.6 (medium)
Allegra
downloadAttachment Cross-Site Scripting Authentication Bypass
4.6 (medium)CVE-2026-11443ZDI-26-358
2026-06-11
Execute script in the context of the current user.
flaw in
the downloadAttachment method
caused by
the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
network
complexity
low
privs required
low
user interaction
required
scope
unchanged
confidentiality
low
integrity
low
availability
none
reportedpublished
2025-10-082026-06-11
246 days to disclosure
0x287.5 (high)
ATEN Unizon
RpcProvider Missing Authentication Denial-of-Service
7.5 (high)CVE-2026-5057ZDI-26-272
2026-04-15
Create a denial-of-service condition on the system.
flaw in
the RpcProvider class
caused by
the lack of authentication prior to allowing access to functionality
NVD ↗
attack vector
network
complexity
low
privs required
none
user interaction
none
scope
unchanged
confidentiality
none
integrity
none
availability
high
reportedpublished
2026-01-302026-04-15
75 days to disclosure
0x277.8 (high)
Samsung MagicINFO 9 Server
Incorrect Default Permissions Local Privilege Escalation
7.8 (high)CVE-2026-25203ZDI-26-268
2026-04-15
Escalate privileges and execute arbitrary code in the context of SYSTEM.
flaw in
the product installer
caused by
incorrect permissions on a folder used by the product
requires
obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability
NVD ↗
attack vector
local
complexity
low
privs required
low
user interaction
none
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2025-12-162026-04-15
120 days to disclosure
0x264.9 (medium)
Cisco Identity Services Engine
getSpecificPLRfromAuthCode XML External Entity Processing Information Disclosure
4.9 (medium)CVE-2026-20029ZDI-26-019
2026-01-09
Disclose information in the context of the application.
flaw in
the implementation of the getSpecificPLRfromAuthCode method
NVD ↗
attack vector
network
complexity
low
privs required
high
user interaction
none
scope
unchanged
confidentiality
high
integrity
none
availability
none
reportedpublished
2025-08-142026-01-09
148 days to disclosure
0x2510.0 (critical)
Cisco Identity Services Engine
invokeStrongSwanShellScript Command Injection Remote Code Execution
10.0 (critical)CVE-2025-20281ZDI-25-609write-up
2025-07-17
Execute code in the context of root.
flaw in
the implementation of the invokeStrongSwanShellScript method
caused by
the lack of proper validation of a user-supplied string before using it to execute a system call
Write-up ↗: CVE-2025-20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability NVD ↗
attack vector
network
complexity
low
privs required
none
user interaction
none
scope
changed
confidentiality
high
integrity
high
availability
high
reportedpublished
2025-05-022025-07-17
76 days to disclosure
0x247.8 (high)
Autodesk AutoCAD
MODEL File Parsing Out-Of-Bounds Read Remote Code Execution
7.8 (high)CVE-2025-1652ZDI-25-163with Mat Powell
2025-03-18
Execute code in the context of the current process.
flaw in
the parsing of MODEL files
caused by
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2025-02-182025-03-18
28 days to disclosure
0x237.8 (high)
Autodesk AutoCAD
MODEL File Parsing Out-Of-Bounds Read Remote Code Execution
7.8 (high)CVE-2025-1433ZDI-25-155with Mat Powell
2025-03-18
Execute code in the context of the current process.
flaw in
the parsing of MODEL files
caused by
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2025-02-112025-03-18
35 days to disclosure
0x227.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Heap-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2025-22880ZDI-25-098
2025-02-25
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-09-192025-02-25
159 days to disclosure
0x217.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Heap-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-47964ZDI-24-1656
2024-12-11
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-09-032024-12-11
99 days to disclosure
0x207.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Uninitialized Variable Remote Code Execution
7.8 (high)CVE-2024-47966ZDI-24-1411with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper initialization of memory prior to accessing it
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-122024-10-15
95 days to disclosure
0x1f7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1403
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-08-272024-10-15
49 days to disclosure
0x1e7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1400with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-252024-10-15
82 days to disclosure
0x1d7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Heap-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-47964ZDI-24-1399with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-252024-10-15
82 days to disclosure
0x1c7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-47962ZDI-24-1396with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-182024-10-15
89 days to disclosure
0x1b7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1394with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-162024-10-15
91 days to disclosure
0x1a7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1393with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-162024-10-15
91 days to disclosure
0x197.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1392with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-162024-10-15
91 days to disclosure
0x187.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1391with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-162024-10-15
91 days to disclosure
0x177.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Read Remote Code Execution
7.8 (high)CVE-2024-47965ZDI-24-1388with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-122024-10-15
95 days to disclosure
0x167.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)no CVE assignedZDI-24-1387with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-122024-10-15
95 days to disclosure
0x157.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1386with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-122024-10-15
95 days to disclosure
0x147.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1385with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-122024-10-15
95 days to disclosure
0x137.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-47963ZDI-24-1384with Fritz Sands
2024-10-15
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-07-122024-10-15
95 days to disclosure
0x127.8 (high)
Autodesk AutoCAD
STEP File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-23147ZDI-24-964
2024-07-25
Execute code in the context of the current process.
flaw in
the parsing of STEP files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-032024-07-25
113 days to disclosure
updated 2024-08-15
0x117.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-39881ZDI-24-952with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x107.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Heap-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-39883ZDI-24-951with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x0f7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-39881ZDI-24-950with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x0e7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Heap-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-39883ZDI-24-949with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x0d7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Read Remote Code Execution
7.8 (high)CVE-2024-39882ZDI-24-948with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x0c7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-39881ZDI-24-947with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x0b7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-39881ZDI-24-946with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x0a7.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-39881ZDI-24-945with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x097.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-39880ZDI-24-944with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x087.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-39880ZDI-24-943with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x077.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Out-Of-Bounds Read Remote Code Execution
7.8 (high)CVE-2024-39882ZDI-24-942with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-172024-07-22
96 days to disclosure
updated 2024-08-15
0x067.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-39881ZDI-24-941with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-03-272024-07-22
117 days to disclosure
updated 2024-08-15
0x057.8 (high)
Delta Electronics CNCSoft-G2
DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution
7.8 (high)CVE-2024-39880ZDI-24-940with Fritz Sands
2024-07-22
Execute code in the context of the current process.
flaw in
the parsing of DPAX files
caused by
the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-03-272024-07-22
117 days to disclosure
updated 2024-08-15
0x047.8 (high)
Autodesk AutoCAD0DAY
SLDASM File Parsing Memory Corruption Remote Code Execution
7.8 (high)CVE-2024-23157ZDI-24-800
2024-06-18
Execute code in the context of the current process.
flaw in
the parsing of SLDASM files
caused by
the lack of proper validation of user-supplied data, which can result in a memory corruption condition
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-032024-06-18
76 days to disclosure
updated 2024-08-15
0x037.8 (high)
Autodesk AutoCAD
STEP File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-23120ZDI-24-775
2024-06-13
Execute code in the context of the current process.
flaw in
the parsing of STEP files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-04-122024-06-13
62 days to disclosure
updated 2024-08-15
0x027.8 (high)
Adobe Acrobat Reader DC
PDF File Parsing Out-Of-Bounds Write Remote Code Execution
7.8 (high)CVE-2024-30310ZDI-24-483
2024-05-19
Execute code in the context of the current process.
flaw in
the handling of PDF files
caused by
the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2024-01-302024-05-19
110 days to disclosure
updated 2024-07-01
0x013.3 (low)
Adobe Acrobat Reader DC
PDF File Parsing Out-Of-Bounds Read Information Disclosure
3.3 (low)CVE-2024-34101ZDI-24-477
2024-05-19
Execute arbitrary code in the context of the current process.
flaw in
the parsing of PDF files
caused by
the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer
requires
the target must visit a malicious page or open a malicious file
NVD ↗
attack vector
local
complexity
low
privs required
none
user interaction
required
scope
unchanged
confidentiality
low
integrity
none
availability
none
reportedpublished
2024-03-082024-05-19
72 days to disclosure
updated 2024-07-01
0x007.5 (high)
PDF-XChange Editor
Updater Improper Certificate Validation Remote Code Execution
7.5 (high)CVE-2024-27323ZDI-24-198with Anthony Fuller
2024-02-23
Execute code in the context of the current user.
flaw in
the update functionality
caused by
the lack of proper validation of the certificate presented by the server
NVD ↗
attack vector
adjacent
complexity
high
privs required
none
user interaction
none
scope
unchanged
confidentiality
high
integrity
high
availability
high
reportedpublished
2023-09-272024-02-23
149 days to disclosure
updated 2024-07-01

Write-ups

CVE Highlights

Cisco Identity Services Engine

Oracle

Oracle PeopleSoft

Adobe Acrobat Reader DC

Advisories

Upcoming15

Published47

Upcoming15

Published47