CVE Vulnerability Catalog

Multiple stack-based buffer overflows were discovered in the xmlcatalog utility of libxml2 when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. Supplying an overly long input line can overflow internal buffers (command, arg, and argv) during input parsing.

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. By decompressing a specially crafted LZW file followed by an LZH file in one gzip -d command, an attacker can poison the shared global state and trigger an out-of-bounds read in the LZH decoder.

GNU gzip has a vulnerability in the gzexe utility related to insecure temporary file handling. When mktemp is not available in the user's PATH, gzexe creates a temporary file with a predictable name based solely on the PID, without exclusive access or existence checks. A local attacker can pre-create this path as a symlink to an arbitrary writable file, causing a TOCTOU condition that allows arbitrary file overwrite.

A stack-based buffer overflow vulnerability was found in the formPPPoESetup function of the /goform/formPPPoESetup file in Edimax EW-7478APC version 1.04. An attacker can remotely manipulate the pppUserName argument, causing a buffer overflow. The exploit has been made public and could be used.

A stack-based buffer overflow vulnerability was found in Edimax EW-7478APC version 1.04 in the formL2TPSetup function. An attacker can remotely manipulate the L2TPUserName argument, causing a buffer overflow. The exploit is public, and the vendor did not respond.

A buffer overflow vulnerability was found in Edimax EW-7478APC version 1.04 in the formiNICSiteSurvey function of the /goform/formiNICSiteSurvey file. Manipulation of the selSSID argument allows remote attack. The exploit has been published and may be used.

A vulnerability was found in Edimax EW-7478APC version 1.04, allowing OS command injection via the rootAPmac argument in the formiNICbasic function. The attack is remotely exploitable and the exploit is publicly available.

A security vulnerability has been detected in Edimax EW-7478APC 1.04, where the formAccept function in /goform/formAccept of the POST Request Handler component is vulnerable to OS command injection via the submit-url argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in Real State Services 1.0 in the file /single-list_sale.php?action=add. Manipulating the ID argument allows remote exploitation. The exploit is publicly available, increasing the risk of attacks.

A security flaw has been discovered in CodeAstro Complaint Management System 1.0, affecting the Report Handler component. Manipulation of the Report Title argument in the /report/addreport file leads to cross-site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly released.

The Embed Privacy plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions from 1.0.0 through 1.12.3.

A relative path traversal vulnerability in libzypp before 17.38.10 allows remote attackers to overwrite system files by processing malicious repository metadata. This can lead to denial of service or privilege escalation.

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) in yelp-xsl. A malicious Flatpak app can open crafted help content via the OpenURI portal, and embedding untrusted CSS in SVG documents bypasses Flatpak's sandbox isolation. This allows Yelp to read local XML files and disclose arbitrary user-readable host files through remote CSS requests.

A cross-site scripting vulnerability was found in itsourcecode Online Hotel Management System 1.0 in the file /admin/mod_room/controller.php?action=add. Manipulation of the Name argument in a POST request allows remote injection of malicious scripts. The exploit is publicly available.

A cross-site scripting vulnerability was found in itsourcecode Online Hotel Management System 1.0. An unknown part of the file /admin/mod_users/controller.php?action=edit in the POST Request Handler component allows manipulation of the Name argument, leading to script execution. The attack can be performed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in Online Hotel Management System 1.0 in the file /admin/mod_users/controller.php?action=add. Manipulation of the Name argument allows remote SQL injection. The exploit has been made public, increasing attack risk.

A cross-site scripting vulnerability was found in Online Hotel Management System 1.0 in the file /admin/mod_amenities/controller.php?action=add. Manipulation of the Name argument in a POST request allows remote script injection. The exploit has been disclosed.

A flaw in Online Hotel Management System 1.0 in the file /admin/mod_amenities/controller.php?action=add allows unrestricted file upload via the image argument. This can lead to remote code execution. The exploit has been published and may be used.

A SQL injection vulnerability was found in the Online Hotel Management System 1.0 in the file /admin/mod_amenities/controller.php?action=edit. An attacker can remotely manipulate the amen_id argument, leading to SQL injection. The exploit is publicly available.

Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in the check_server_certificate() function. An unauthenticated attacker can trigger reads beyond valid buffer boundaries by crafting a Certificate handshake message with a specific fragment_length value.