CVE Vulnerability Catalog

Vulnerability in LangChain before versions 0.3.85 and 1.3.3. Older runtime code paths deserialize inputs/outputs using overly broad object allowlists, allowing an attacker to supply malicious constructor dictionaries and instantiate objects with dangerous arguments.

Banks before version 2.4.2 uses unsandboxed jinja2.Environment() to render prompt templates, allowing Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) on the host.

Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.

Student Transcript Processing System 1.0 from itsourcecode has an SQL injection vulnerability in /admin/modules/class/index.php?view=view via the ID argument. The attack can be performed remotely, and the exploit is publicly available.

Student Transcript Processing System 1.0 from itsourcecode has an SQL injection vulnerability in /admin/modules/student/trans.php via the studentId or cid arguments. The attack can be performed remotely, and the exploit is publicly available.

Student Transcript Processing System 1.0 from itsourcecode has an SQL injection vulnerability in /admin/modules/student/index.php?view=view via the studentId argument. The attack can be performed remotely, and the exploit is publicly available.

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.

An authentication bypass vulnerability in code100x's Mobile API allows unauthenticated attackers to impersonate arbitrary users by sending a crafted JSON payload in the 'g' HTTP header.

Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.

XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.

Privilege escalation via background service in OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges through a local IPC channel.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

Denial of service vulnerability in IBM HTTP Server versions 8.5 and 9.0 via the optional module mod_mem_cache.

IBM HTTP Server 8.5 and 9.0 is vulnerable to invalid pointer dereference. A privileged user authenticated to the Administration Server could exploit this to expose sensitive information or cause a denial of service.

IBM HTTP Server 8.5 and 9.0 contain a buffer overflow vulnerability. A privileged user authenticated to the Administration Server could exploit this to execute remote code or cause a denial of service.

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty are vulnerable to HTTP request smuggling. An attacker can send a specially crafted request that is misinterpreted by the server.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability, allowing arbitrary code execution in the context of the current process.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a memory corruption vulnerability. An attacker can leverage this to execute arbitrary code in the current process context.

A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an out-of-bounds write vulnerability. An attacker may leverage this to cause a crash, data corruption, or arbitrary code execution.