CVE Vulnerability Catalog

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application. Exploitation requires user interaction – the victim must open a malicious file.

Substance3D - Designer is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Substance3D - Sampler is affected by a heap-based buffer overflow vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by a heap-based buffer overflow vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by a heap-based buffer overflow vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by a heap-based buffer overflow vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Substance3D - Sampler is affected by a stack-based buffer overflow vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.

FluentCRM Pro plugin for WordPress up to version 3.1.12 is vulnerable to SQL Injection due to insufficient escaping and lack of query preparation. Authenticated attackers with Author-level access or above can append additional SQL queries to extract sensitive information from the database.

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.