CVE Vulnerability Catalog

W systemie Supermicro MBD-X13SEM-F występuje podatność w logice walidacji firmware'u BMC. Atakujący może zaktualizować firmware systemu za pomocą specjalnie przygotowanego obrazu.

W firmware BMC Supermicro MBD-X12STW-F występuje podatność w logice walidacji. Atakujący może zaktualizować firmware systemu za pomocą specjalnie przygotowanego obrazu.

Delta Electronics DIAView has Command Injection vulnerability.

Wtyczka All-in-One Video Gallery dla WordPressa jest podatna na nieautoryzowane przesyłanie plików we wszystkich wersjach do i włącznie z 4.5.7. Problem wynika z niewystarczającej walidacji typów plików, co pozwala na ominięcie sanitizacji plików z podwójnymi rozszerzeniami, które są akceptowane jako prawidłowe pliki VTT.

Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to query database contents.

Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.

The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements.

The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in certain man-in-the-middle or passive inspection scenarios.

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files.

The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server.

The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.

Nsauditor version 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer of 256 repeated characters into the 'Key' field to trigger an application crash.

NBMonitor 1.6.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can paste a 256-character buffer into the registration key field to trigger an application crash and potential system instability.

Backup Key Recovery w wersji 2.2.7 zawiera podatność na atak typu denial of service, która pozwala atakującym na spowodowanie awarii aplikacji poprzez przepełnienie pola wejściowego kodu rejestracyjnego. Atakujący mogą wkleić dużą buforowaną wartość składającą się z 256 powtórzonych znaków, co prowadzi do niestabilności aplikacji i potencjalnej awarii.

WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\PROGRAM FILES (X86)\WIBUKEY\SERVER\WkSvW32.exe' to inject malicious executables and escalate privileges.

The vulnerability in Disk Sorter Enterprise 13.6.12 stems from an unquoted service path in its Windows service configuration. It allows a local attacker to inject a malicious executable into the path 'C:\Program Files\Disk Sorter Enterprise\bin\disksrs.exe' and potentially execute arbitrary code with elevated privileges.

Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries located in 'Program Files' directories to inject malicious executables and escalate privileges.

Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Dup Scout Server\bin\dupscts.exe' to inject malicious executables and escalate privileges.

Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries to inject malicious executables that will be run with elevated LocalSystem privileges.