CVE Vulnerability Catalog

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities. These allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions.

The WP Job Portal plugin by Ahmad versions up to 2.5.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.

Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.

Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel from n/a through 1.8.1.

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif from n/a through 1.6.

Improper Control of Filename for Include/Require Statement in PHP Program (PHP Local File Inclusion) vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion.

PHP Remote File Inclusion vulnerability in the Accordion FAQ plugin for WordPress up to version 2.2.1. Allows PHP Local File Inclusion.

Improper Control of Filename for Include/Require Statement in PHP Program (PHP Local File Inclusion) vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion.

A path traversal vulnerability in jupyter-server 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function. This allows unauthorized read/write access to files in sibling directories.

The Thim Core plugin for WordPress (versions up to 2.3.3) contains a missing authorization vulnerability. This means that unauthorized users can perform operations requiring privileges, potentially leading to unauthorized access to administrative functions.

The Accordion FAQ plugin by UnboundStudio versions up to 2.2.1 has a Reflected XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious script via a crafted URL, which executes in the victim's browser.

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists because the authentication middleware exempts URL paths ending with 'health' or 'ready'. An attacker can create resources with such names and access them without authentication.

The Route resource in OpenShift allows defining routes to expose pods via HAProxy. Insufficient validation of the spec.path field in a Route document could allow controlled injection of HAProxy configuration.

The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session without completing the email OTP challenge.

A vulnerability in Strongbox causes memory corruption due to a buffer overflow when using the feature.

Memory corruption occurs in Strongbox due to a missing bounds check.

Memory corruption vulnerability when accessing shared buffers without validation of concurrent user-mode input modifications.

A vulnerability causes memory corruption while processing multiple IOCTL commands for escape operations.

A vulnerability causes memory corruption while processing IOCTL calls for escape operations.