CVE Vulnerability Catalog

In Spring for Apache Kafka versions 3.0.9 and earlier and 2.9.10 and earlier, a possible deserialization attack vector exists, but only if unusual configuration is applied. An attacker would need to construct a malicious serialized object in one of the deserialization exception record headers.

Wireshark versions 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 have a memory leak in the BT SDP dissector, allowing denial of service via packet injection or crafted capture files.

Wireshark versions 4.0.0 to 4.0.6 contain a bug in the CBOR dissector that can lead to application crashes. An attacker can exploit this via packet injection or a crafted capture file to cause denial of service.

Wireshark versions 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 contain a vulnerability in the BT SDP dissector that can lead to an infinite loop. An attacker can exploit this flaw through packet injection or by crafting a malicious capture file.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized data disclosures.

The vulnerability in CP-Plus DVR is due to improper input validation within the web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.

A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. The presence of an unauthorized service may enable unauthorized access to the device.

Cross Site Scripting (XSS) vulnerability in Sourcecodester Student Study Center Desk Management System version 1.0 allows attackers to run arbitrary code via crafted GET request to web application URL.

The vulnerability in the Shescape library for JavaScript may impact Windows users in a threaded context. It can lead to incorrect escaping for the wrong shell, allowing attackers to bypass protections.

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter.

Argo CD, a GitOps continuous delivery tool for Kubernetes, has a bug in versions starting from 2.6.0 that causes open web terminal sessions to not expire. This allows users to send websocket messages even after the token has expired.

OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 are vulnerable to XXE injection attacks in the file editor accessible to users with ROLE_FILESYSTEM_EDITOR privileges.

Apache Airflow and its SMTP and IMAP providers before specified versions are affected by the OpenSSL Certificate validation vulnerability. The default SSL context did not check the server's X.509 certificate, which could lead to the disclosure of mail server credentials or mail contents.

A flaw was found in ghostscript for Red Hat Enterprise Linux 8, where the fix for CVE-2020-16305 was not included as previously claimed. This issue affects the ghostscript package specifically.

libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure.

The hcaptcha extension (also known as hCaptcha for EXT:form) before version 2.1.2 for TYPO3 has an issue with verifying that the required CAPTCHA field is submitted in the form data, allowing a remote user to bypass the CAPTCHA check.

An issue was discovered in MISP version 2.4.174 related to a reflected XSS vulnerability. The issue exists in app/Controller/DashboardsController.php via the id parameter during dashboard editing.

CVE-2023-40282 describes an improper authentication vulnerability in Rakuten WiFi Pocket devices, allowing a network-adjacent attacker to log into the Management Screen. This may lead to the exposure of sensitive information or changes to the device settings.

IBM Robotic Process Automation versions 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory.