CVE Vulnerability Catalog

FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type (e.g., E2nodeConfigurationUpdate) to crash the near-RT RIC process (port 36421) via SIGABRT.

FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.

FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp registry enforces node ID uniqueness via assert(), allowing a remote unauthenticated attacker to crash the iApp process via SIGABRT.

FlexRIC v2.0.0 has a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp process (port 36422) via SIGABRT. Since iApp and the near-RT RIC share one process, this terminates the entire RIC service and disconnects all E2 Nodes and xApps.

FlexRIC v2.0.0 uses hardcoded assertions to validate IE counts in decoded E2AP messages. A remote unauthenticated attacker can crash the near-RT RIC or iApp via SIGABRT by sending a valid PDU with unexpected IE count.

A vulnerability in php-censor up to version 2.1.6, in the file src/Model/Build/GitBuild.php, allows remote OS command injection via manipulation of the commitId argument in the Webhook endpoint.

In D-Link DI-7001 MINI up to version 19.09.19A1, the sprintf function in /httpd_debug.asp (API component) is vulnerable to stack-based buffer overflow via the Time argument. The attack can be performed remotely and the exploit is publicly available.

Integer overflow in Poppler's Splash backend tilingPatternFill function leads to undersized heap allocation and out-of-bounds write. Remote code execution, information disclosure, or denial of service possible.

Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tychon contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.

LearnPress WordPress plugin is vulnerable to Reflected XSS due to improper input neutralization during page generation. Affects versions up to 4.3.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.

The VikBooking Hotel Booking Engine & PMS WordPress plugin (versions up to 1.8.8) has a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.

The e2pdf WordPress plugin (versions up to 1.32.14) has a Reflected Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation.

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to the FTP server hosting application update packages. The attacker could upload a malicious update file, which could then be distributed and installed as a legitimate update.

FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no pending event. The near-RT RIC uses assert() to enforce a pending event. A remote unauthenticated attacker can send a forged response to port 36421, causing SIGABRT (Debug) or NULL pointer dereference (SIGSEGV) in Release builds.

FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by completing an SCTP handshake and immediately disconnecting without sending any E2AP message.

SourceCodester Computer Repair Shop Management System up to version 1.0 has an SQL injection vulnerability in /admin/products/manage_product.php via manipulation of the ID argument. The attack can be launched remotely, and the exploit has been made public.

Real State Services 1.0 by code-projects has an SQL injection vulnerability in /loginuser.php of the Login component via manipulation of the Username argument. The attack can be initiated remotely, and the exploit has been disclosed to the public.

A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /users/application_status.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in CodeAstro Online Job Portal 1.0 in the file /admin/jobs-admins/delete-jobs.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.