CVE Vulnerability Catalog

A path traversal vulnerability was found in carRental in the downloadShowFile function in /file/downloadShowFile.action. Manipulation of the path argument allows remote attack. The project has not responded to the report.

A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.

A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.

An unrestricted upload vulnerability was found in wangmarket up to 6.4, in the uploadImage function of the file /sits/uploadImage.do. Manipulating the image argument allows remote exploitation.

A server-side request forgery (SSRF) vulnerability was found in go-sonic up to 1.1.4, in the FetchTheme function of the file service/theme/git_fetcher.go. Manipulating the uri argument allows remote attack.

An out-of-bounds read vulnerability was found in WebAssembly wabt up to 1.0.39, in the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile. Local access is required for the attack.

A vulnerability in WebAssembly wabt up to 1.0.39 affects the function wabt::AST::InsertNode in the file /src/repro/wabt/bin/wasm-decompile of the wasm-decompile component. The manipulation causes memory corruption. The attack can be launched on the local host, and the exploit has been made publicly available.

Signal K Server before version 2.19.0 has a vulnerability in the access request system that combines two related issues: improper display of the `permissions` field (less visible than the description) and unconditional trust in the `X-Forwarded-For` header for determining the client's IP address. An attacker can exploit these flaws to craft a convincing social engineering attack against an administrator, impersonating a trusted device and requesting elevated permissions.

Signal K Server prior to version 2.19.0 has an unauthenticated information disclosure vulnerability allowing any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. Version 2.19.0 patches the issue.

A release of invalid pointer or reference vulnerability was discovered in the fs/inode/fs_inoderemove code of Apache NuttX RTOS, affecting versions from 10.0.0 before 12.10.0. It can lead to a debug assert trigger (disabled by default), NULL pointer dereference, or generally a Denial of Service. Users of filesystem-based services with write access exposed over the network (e.g., FTP) are affected.

A flaw was found in PHPGurukul Online Course Registration up to 3.1 affecting an unknown function, causing missing authorization. Remote exploitation is possible, and the exploit has been published.

A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.php. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server's designated upload directories. However, the server's architecture restricts uploaded files to non-executable storage locations and prevents modification or replacement of existing components, so the impact is low.

ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server's designated upload directories. However, the server's architecture restricts uploaded files to non-executable storage locations and prevents modification or replacement of existing components, so the impact is low.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.