CVE Vulnerability Catalog

Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting vulnerability via the cat_id parameter at /shop/?module=shop&action=search.

A critical vulnerability was found in IBOS OA 4.5.5, affecting the actionExport function of the file ?r=contact/default/export of the Personal Office Address Book component. Manipulation of this function leads to SQL injection.

Omnis Studio 10.22.00 has incorrect access control, allowing 'always private' Omnis libraries to be opened. Although this feature is supposed to be an irreversible operation, implementation issues allow bypassing specific checks.

Omnis Studio 10.22.00 has incorrect access control, allowing locked classes in Omnis libraries to be unlocked. This violates the expected behavior of an 'irreversible operation', enabling actions such as deleting, viewing, or modifying these classes.

IceWarp version 10.2.1 was found to have a cross-site scripting (XSS) vulnerability via the color parameter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

A vulnerability was found in Samba's SMB2 packet signing mechanism. SMB2 packet signing is not enforced if an admin configured 'server signing = required' or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory.

CVE-2023-34968 is a path disclosure vulnerability in Samba that allows the server-side absolute path of shares, files, and directories to be disclosed in search query results. An attacker can exploit this flaw to view information contained in the disclosed path.

A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. The issue occurs when parsing Spotlight mdssvc RPC packets, potentially leading to a crash of the mdssvc worker process when a malicious client calls the dalloc_value_for_key() function.

A vulnerability classified as problematic has been found in Aures Komet up to version 20230509, affecting the Kiosk Mode component. Manipulation leads to improper access controls, allowing an attack on the physical device.

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to and including 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This allows unauthenticated attackers to obtain a site's MailChimp API key.

HashiCorp Nomad and Nomad Enterprise versions 0.11.0 up to 1.5.6 and 1.4.1 have a vulnerability in the HTTP search API that can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy.

In HashiCorp Nomad and Nomad Enterprise versions 0.7.0 to 1.5.6 and 1.4.10, ACL policies using a block without a label generate unexpected results. This issue is fixed in versions 1.6.0, 1.5.7, and 1.4.11.

CVE-2023-3782 affects the OkHttp client, which can experience a denial of service (DoS) when using BrotliInterceptor while visiting a malicious web server or when an attacker can perform a MitM attack to inject a Brotli zip-bomb into an HTTP response.

A vulnerability in aiohttp (up to version 3.8.4) allows HTTP request smuggling attacks due to misinterpretation of HTTP header values. This affects users running aiohttp as an HTTP server.

An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.

An infinite loop was discovered in the ngiflib library in the DecodeGifImg function, which may lead to application hang when processing GIF images.

All versions of GE Digital CIMPLICITY that do not adhere to SDG guidance and accept documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation. This includes problems such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and heap-based buffer overflow.

The issue is that checking excessively long DH keys or parameters may be very slow. Applications using the functions DH_check(), DH_check_ex(), or EVP_PKEY_param_check() may experience long delays, which could lead to a Denial of Service attack if the keys or parameters are obtained from an untrusted source.

A vulnerability was found in Intergard SGS 8.7.0, leading to cleartext storage of sensitive information in memory. The attack can be initiated remotely.

A vulnerability has been found in Intergard SGS 8.7.0 affecting an unknown functionality of the Change Password Handler component. Manipulation of this vulnerability leads to denial of service, and the attack can be launched remotely.