CVE Vulnerability Catalog

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory.

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

The lack of lock bit protection for NBIO registers may allow a local admin-privileged attacker to gain arbitrary access to the System Management Network (SMN), potentially leading to arbitrary code execution in the AMD Secure Processor (ASP) and loss of confidentiality and integrity for SEV-SNP guests.

The installation of Fuji Tellus adds a kernel driver that grants all users read and write permissions. This means any system user can gain unauthorized access to critical kernel resources.

The MonsterInsights – Google Analytics Dashboard for WordPress plugin is vulnerable to unauthorized access and data modification due to missing capability checks on the get_ads_access_token() and reset_experience() functions. Authenticated attackers with Subscriber-level access and above can retrieve live Google OAuth access tokens and reset the plugin's Google Ads integration.

ChurchCRM is an open-source church management system. Prior to version 7.3.2, an attacker could exploit top-level GET navigation from an external page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, allowing a logged-in user with the relevant role to silently delete records.

A Remote Code Execution vulnerability in Claris FileMaker Cloud allows a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature.

A Remote Code Execution vulnerability in Claris FileMaker Cloud allows a user with Admin Console privileges to bypass a front-end restriction on OS Script schedule types and execute arbitrary operating system commands on the underlying host.

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation.

Flowsint is an OSINT graph exploration tool that prior to version 1.2.3 allowed a remote attacker to create a node with a malicious type, which could lead to escaping an existing Cypher query and executing arbitrary Cypher queries.

The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up to and including 1.10.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

Heym before version 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor. Authenticated workflow authors can bypass sandbox restrictions using object-graph introspection primitives.

Heym before version 0.0.21 contains an authorization bypass vulnerability in workflow execution. An authenticated attacker can execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation.

A path traversal vulnerability in Heym before version 0.0.21 allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. The flaw exists in the file upload endpoint where the filename parameter is not properly validated.

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypassed the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory.

Lemur manages TLS certificate creation. Prior to version 1.9.0, Lemur's LDAP authentication module constructs LDAP search filters using unsanitized user input, allowing LDAP users to inject LDAP filter metacharacters.

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to version 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes.

Hugo, a static site generator, had a vulnerability in versions from 0.43 to before 0.161.0 that allowed unrestricted file system access during the build of sites using Node-based asset pipelines. Running hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory.