Статьи Support
🚨 CVE-2026-43832
A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.
🚨 CVE-2026-43831
A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.
🚨 CVE-2026-43833
A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.
🚨 CVE-2026-113402
ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.
🚨 CVE-2026-113403
ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.
🚨 CVE-2024-2323
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted...
🚨 CVE-2026-111090
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.
🚨 CVE-2026-112177
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a...
🚨 CVE-2026-113405
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
🚨 CVE-2026-113406
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
🚨 CVE-2026-113407
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
🚨 CVE-2026-43834
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
🚨 CVE-2026-43835
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
🚨 CVE-2026-96596
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a...
🚨 CVE-2026-84823
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the...
🚨 CVE-2026-101201
A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.
🚨 CVE-2026-113465
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.
To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated...
🚨 CVE-2026-113469
A failure has been identified in the SNS during dynamic data files signature check.
A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
🚨 CVE-2026-43837
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
🚨 CVE-2026-11959
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.