CVE Vulnerability Catalog

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/userproductdeletequery.php. Manipulating the user_id argument allows remote attack. The exploit is publicly available.

A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data.

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker with access to the relevant HTTP interface can inject shell metacharacters, leading to arbitrary code execution with root privileges.

An OS command injection vulnerability exists in the TR-069/CWMP management interface of Archer VX1800v v1 due to insufficient input validation, allowing crafted input to be executed as system-level commands.

An SSRF vulnerability in Nexus Repository 3 allows an attacker controlling a proxy repository upstream server to redirect requests to internal network addresses or cloud metadata endpoints. A user with read access to such a repository may receive sensitive information, including cloud IAM credentials.

A vulnerability in CompactLogix 5380, ControlLogix 5580, and EN4 communication modules involves improper rejection of certificates signed by a revoked intermediate certificate. The controller fails to validate CRLs correctly, allowing an attacker to establish a connection with a certificate that should be untrusted.

A Stored Cross-Site Scripting vulnerability exists in FactoryTalk® DataMosaix™ Private Cloud due to improper neutralization of user-supplied input in Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts permanently stored on the server, leading to JavaScript execution when other users access the affected page.

A code execution vulnerability exists in Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. Executable paths containing spaces are not properly quoted, allowing an attacker to place a malicious executable earlier in the search order and achieve arbitrary code execution.

A remote code execution vulnerability exists in Studio 5000 Logix Designer due to incorrect authorization on a configuration file. Any authenticated user can modify the paths of external tools configured within the application. An attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

A path traversal vulnerability exists in Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during project opening, allowing path traversal sequences. Exploitation could allow an attacker to write arbitrary files to attacker-controlled locations, potentially leading to code execution.

In Roundcube Webmail before versions 1.6.17 and 1.7.2, insufficient CSS sanitization in HTML email messages may lead to SSRF or information disclosure when stylesheet links point to local network hosts.

Vulnerability in DBI::ProfileData for Perl before version 1.651 does not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser, and an unbounded value allows an attacker to specify a large index and consume available memory.

A vulnerability in Fortinet FortiSIEMWindowsAgent versions 7.4.0 through 7.4.1 is due to improper restriction of communication channel to intended endpoints. This could allow an attacker to escalate privileges.

A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.

A vulnerability in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8 allows an unauthenticated attacker to access the VNC server of scanning VMs. The issue is due to improper resource access restrictions.

A vulnerability in the Pillow Python imaging library allows controlled native heap corruption via the ImageCms.ImageCmsTransform.apply(im, imOut) API when the output image mode does not match the declared transform output mode. This issue is fixed in version 12.3.0.

Vulnerability in Pillow (versions 8.2.0 through 12.2.0) causes excessive memory usage when decoding a crafted tiled JPEG2000 file, potentially leading to denial of service (OOM).

A vulnerability in the Pillow Python imaging library allows a native heap out-of-bounds write when processing image coordinates near signed 32-bit integer limits in Image.paste(), Image.crop(), and Image.alpha_composite(). The issue is fixed in version 12.3.0.

In Easy!Appointments version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.

A vulnerability in DBD::File for Perl before version 1.651 allows bypassing file access restrictions. The complete_table_name method does not verify if the table file is a symlink to an untrusted location.