CVE Vulnerability Catalog

Kiteworks prior to version 9.3.0 has a reflected XSS vulnerability in Secure Data Forms, allowing an external attacker to trick a user into executing arbitrary JavaScript code. Fixed in version 9.3.0.

In code-projects Hotel and Tourism Reservation System 1.0, the password_verify function in /admin/login.php improperly authenticates the Password argument, leading to improper authentication. The attack is remotely exploitable. The exploit is public.

In SourceCodester SEO Meta Tag Extractor 1.0, the get_headers function in /index.php is vulnerable to server-side request forgery (SSRF) via manipulation of the url argument. The attack can be executed remotely and the exploit has been made public.

lwext4 1.0.0 has a NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h. An attacker can supply a specially crafted EXT4 filesystem image with malformed directory entries, causing a segmentation fault (DoS).

Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN apertures leading to a potential escalation of privileges.

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.

IBM WebSphere Application Server 9.0 and 8.5 is affected by improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

IBM i Access Family versions 1.1.5.0 through 1.1.9.12, specifically IBM i Access Client Solutions (ACS), is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation.

Microsoft Office SharePoint contains an OS command injection vulnerability. An authorized attacker can execute code remotely due to improper neutralization of special elements.

CloakBrowser prior to version 0.3.28 has a vulnerability in the cloakserve CDP multiplexer that allows an unauthenticated attacker to delete arbitrary directories by supplying a crafted fingerprint value with path traversal sequences. Additionally, cloakserve listens on 0.0.0.0 by default, increasing network exposure.

In Nextcloud Tables (versions 0.9.0 to 0.9.7 and 1.0.0 to 1.0.2), missing sanitization allows a user with access to perform a limited SQL injection in the ORDER BY clause, enabling extraction of a single bit per request or database delay.

Vulnerability in the Tables app in Nextcloud (versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, 1.0.0 to before 1.0.4). An authenticated attacker with access to the Tables app can execute arbitrary SQL queries up to 20 bytes long via stored injection. The length limitation can be bypassed.

Vulnerability in the Node.js library parse-nested-form-data before version 1.0.1. The parseFormData() function does not filter reserved property keys when processing FormData field names, allowing prototype pollution of Object.prototype via a field name starting with __proto__ or containing .__proto__.

An improper authorization vulnerability in the calendar backend of Nextcloud Server (versions 32.0.0-32.0.8 and 33.0.0-33.0.2) allows an authenticated attacker, knowing another user's principal URL, to gain full read and write access to that user's calendar.

A stack-based buffer overflow flaw was found in rrdcached, a component of rrdtool. A local attacker with socket access can send an oversized CREATE request, crashing the daemon (denial of service) or potentially achieving arbitrary code execution.

F5-TTS through version 1.1.20 has a path traversal vulnerability in the finetune Gradio handlers. An unauthenticated attacker can write arbitrary files by passing unsanitized project names to os.path.join(), allowing bypass of the base directory and file creation at arbitrary locations.

Stack-based buffer overflow vulnerability in the microtar library up to version 0.1.0. The raw_to_header() function in src/microtar.c uses strcpy() to copy name or linkname fields from a TAR archive that may lack null terminators, causing writes of up to 355 bytes into a 100-byte destination buffer.

The vulnerability in SMB volume mount handling in CloudFoundry Foundation diego-release allows a low-privileged CF space developer to inject arbitrary kernel CIFS mount options by bypassing the mount-option allowlist. This enables privilege escalation and security control bypass on multi-tenant Diego cells. Affects smb-volume-release before v3.60.0 and CF Deployment before v56.0.0.

FlexRIC v2.0.0 trusts the xapp_id field from E42 messages without binding it to the sender's SCTP association. A remote unauthenticated attacker can impersonate any xApp by sending requests to iApp (port 36422), causing misrouted responses and potentially crashing the victim xApp, RIC, or iApp due to state inconsistencies in the red-black tree.