CVE Vulnerability Catalog

Version 3.5.0 and earlier of Jeecg-boot contains an SQL injection vulnerability that allows a local attacker to cause a denial of service using functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE.

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products, which may allow an attacker with local access and elevated privileges to execute arbitrary code.

A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products, which may allow an attacker with local access and elevated privileges to execute arbitrary code.

A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower than 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).

A use-after-free flaw was found in btrfs_get_dev_args_from_path in the btrfs file system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information.

EC-CUBE versions 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in the 'mail/template' and 'products/product' sections of the Management page. If exploited, an arbitrary script may be executed on the web browser of another administrator or user accessing the website.

CVE-2023-40252 describes an improper control of code generation ('code injection') vulnerability in Genians Genian NAC and Genians ZTNA, allowing for the replacement of trusted executables. This affects versions from V4.0.0 to V4.0.155 for Genian NAC V4.0, from V5.0.0 to V5.0.42 for Genian NAC V5.0, from V5.0.0 to V5.0.54 for Genian NAC Suite V5.0, and from V6.0.0 to V6.0.15 for Genians ZTNA.

A vulnerability in Genians Genian NAC and Genian ZTNA related to missing encryption of sensitive data allows for Man in the Middle attacks. This affects versions V4.0, V5.0, and V6.0.

The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to and including 1.2.0. This allows authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.4, allowing for the storage of malicious code.

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 are vulnerable to server-side request forgery (SSRF). This allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Cognos Analytics versions 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication, which could be used in reconnaissance for future attacks.

Oppia is an online learning platform that uses the equality operator to compare CSRF tokens, making it vulnerable to timing attacks. An attacker can guess the CSRF token, allowing them to perform actions on behalf of a logged-in user.

IBM WebSphere Application Server Liberty versions 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

A NULL pointer dereference flaw was found in dbFree in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.

NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerability, posing a potential risk to the security and integrity of the affected device. The presence of a hardcoded key could potentially facilitate firmware manipulation.

The Favorite View plugin in Jenkins versions 5.v77a_37f62782d and earlier contains a cross-site request forgery (CSRF) vulnerability that allows attackers to add or remove views from another user's favorite views tab bar.

Jenkins Docker Swarm Plugin version 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, leading to a stored XSS vulnerability.

Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers to trigger builds of jobs.