CVE Vulnerability Catalog

In Biztalk360 before version 11.5, an access control issue allows any user to request loading a DLL file. During loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution.

Focalboard 8.0 fails to sanitize category IDs before using them in dynamic SQL statements when reordering categories. An authenticated attacker can inject malicious SQL into the category ID field, leading to exfiltration of password hashes of other users. The product is unsupported and no fix will be issued.

In KVM for ARM64, a fix addresses the initialization of ID registers for non-protected pKVM guests. In protected mode, the hypervisor copied the KVM_ARCH_FLAG_ID_REGS_INITIALIZED flag without initializing the id_regs data, causing ID registers to be zeroed. This led to errors in feature detection, such as TCR2_EL1, and potential state corruption.

In the Linux kernel's accel/amdxdna driver, the command header payload count field is not validated. This could allow specifying a payload size exceeding the available buffer, leading to out-of-bounds read/write.

In the Linux kernel's dpaa2-switch driver, after receiving an invalid if_id in the IRQ handler, the interrupt status is not cleared, leading to an interrupt storm.

In the Linux kernel, a circular locking dependency was found in rds_tcp_tune, where calling sk_net_refcnt_upgrade() while holding the socket lock can cause a deadlock. The fix moves this call outside the critical section.

A Stored XSS vulnerability in the 'Permissions Based on Mailboxes' report of ManageEngine Exchange Reporter Plus before version 5802 allows an attacker to inject a malicious script that is permanently stored on the server.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to stored XSS in the Folder Message Count and Size report. An attacker can inject malicious scripts that execute in other users' browsers.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in the 'Equipment Mailbox Details' report.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.

The Perfmatters plugin for WordPress up to version 2.5.9.1 is vulnerable to arbitrary file deletion via path traversal. The `PMCS::action_handler()` method processes the `$_GET['delete']` parameter without sanitization, authorization, or nonce verification, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server.

An incorrect default permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS. An attacker can execute arbitrary code with SYSTEM privileges if a user places a crafted file in the vulnerable directory. Affects version 7.0.

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 up to version 1.0.6. Attackers can inject newline characters into module options (e.g., RHOSTS), causing unintended command execution in the Metasploit console.

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

In Sudo up to version 1.9.17p2 before commit 3e474c2, a failure of setuid, setgid, or setgroups calls during privilege drop before running the mailer is not a fatal error, which can lead to privilege escalation.

A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.