CVE Vulnerability Catalog

FastNetMon Community Edition up to version 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls. An attacker who can influence argv[] values can inject arbitrary shell commands.

FastNetMon Community Edition up to version 1.2.9 has a configuration injection vulnerability in the Juniper router integration plugin. The $IP_ATTACK variable (from argv[1]) is directly interpolated into NETCONF commands without validation, allowing an attacker to inject additional Juniper CLI commands via newline characters. This can lead to modification of routing tables, firewall filters, user accounts, and other configuration elements.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.

Babel, a JavaScript compiler, from version 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, when compiling attacker-crafted code, can generate output that executes arbitrary code.

SQL injection vulnerability in Chatwoot versions 2.2.0 through 4.11.2 in conversation and contact filter APIs. An authenticated attacker can inject arbitrary SQL via date or number filter parameters.

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, it is vulnerable to stored XSS via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who views the affected page. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts.

FACTION prior to 1.8.3 is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filenames are persisted and rendered into HTML and attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who opens the affected views.

NVIDIA vGPU software has a use-after-free vulnerability in the virtual GPU manager. Successful exploitation may lead to denial of service, privilege escalation, information disclosure, data tampering, and code execution.

NVIDIA Display Driver for Linux has an out-of-bounds read vulnerability. Successful exploitation may lead to denial of service and information disclosure.

NVIDIA Display Driver for Linux has a vulnerability in UVM, where a user can cause improper input validation. Successful exploitation might lead to denial of service.

The NVIDIA Display Driver for Linux has a vulnerability in a kernel mode layer handler, where a user could cause improper permission handling. Successful exploitation might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

The NVIDIA Display Driver for Linux contains a vulnerability where an incorrect conversion between numeric types leads to a heap buffer overflow. Successful exploitation could lead to denial of service, privilege escalation, information disclosure, data tampering, and code execution.

The NVIDIA Display Driver for Windows has a time-of-check time-of-use vulnerability. Successful exploitation can lead to denial of service, privilege escalation, information disclosure, data tampering, and code execution.

NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause improper access to GPU resources. A successful exploit might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

The NVIDIA Display Driver for Linux contains a use-after-free vulnerability. Successful exploitation could lead to denial of service, privilege escalation, information disclosure, data tampering, and code execution.

Vulnerability in STUDENT-MANAGEMENT-SYSTEM (up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5) in the Dashboard component, leading to improper access controls. The attack can be performed remotely, and the exploit is publicly available.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service via the optional module mod_ibm_upload.

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

Insufficient state checks allow bypassing two-factor authentication (2FA) controls.