CVE Vulnerability Catalog

A vulnerability was detected in an unknown function of /pages/pro_edit1.php in itsourcecode Sales and Inventory System 1.0. Manipulation of the prodcode argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed.

A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

In memcached 1.6.41/1.6.42/1.6.43, the try_read_command_asciiauth function in proto_text.c (mcmc Tokenizer component) allows an out-of-bounds read. The attack can be launched remotely and the exploit has been publicly released. The fix is available in version 1.6.44 (commit af05c9302bba508b736c3da1d5670f63fe8b7db4).

A vulnerability was identified in an unknown part of invoice.php in SourceCodester Inventory Management System 1.0. Manipulation of the ID argument leads to authorization bypass, and the attack can be launched remotely. The exploit is publicly available.

A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown functionality of the file /api/products_handler.php of the Product Management Module. Manipulation of the Product_Name argument leads to cross site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed.

The VSIX publishing service limits the compressed file size (ovsx.publishing.max-content-size, 512 MB by default) but does not limit the decompressed entry size. WebResourceService opens the entry via ZipFile.getInputStream() and copies the decompressed stream without counting bytes, and the java.io.tmpdir cache is evicted by entry count (150), not size, allowing a publisher with their own namespace to fill the temp filesystem.

multer, a Node.js middleware for handling multipart/form-data uploads, in versions 2.2.0 through 2.3.0 does not remove files written after abort cleanup when a disk storage upload is aborted mid-upload. Each aborted upload can leave an orphaned file on disk.

A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown functionality of the file /api/vendors_handler.php of the Vendor Management component. Manipulation results in cross site scripting. The attack is possible to be carried out remotely, and the exploit has been made public.

A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown function of the file /api/customers_handler.php of the Customer Management Module. Manipulation of the Customer_Name argument leads to cross site scripting. The attack can be executed remotely, and the exploit has been disclosed to the public.

A flaw has been found in D-Link DIR-878 120B05 impacting the SetWan3Settings function of the WAN Settings component. Manipulation of the Primary/Secondary argument causes a stack-based buffer overflow. Remote exploitation of the attack is possible.

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM.

A vulnerability was detected in D-Link DIR-878 120B05 affecting the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. Manipulation of the IPv6Address/Hostname argument results in a stack-based buffer overflow. The attack may be launched remotely.

A security vulnerability has been detected in 0x4m4 HexStrike AI in the FileOperationsManager function of hexstrike_server.py (API Files Endpoint component). Manipulation of the filename argument leads to path traversal. The attack may be initiated remotely and the exploit has been publicly disclosed.

A weakness has been identified in 0x4m4 HexStrike AI in the subprocess.Popen function of hexstrike_server.py (API Tools Endpoint component). Manipulation of the additional_args/target/username/password/scan_type/payload arguments can lead to OS command injection. The attack can be launched remotely and the exploit has been made available to the public.

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC in the formDelWebAuthWhiteUser function. Manipulation of the webAuthWhiteUserIndex argument results in a stack-based buffer overflow. The attack can be initiated remotely.

In Tenda W20E 15.11.0.61068_1546_841_CN_TDC, the formIPMacBindAdd function of the HTTP Handler component mishandles the IPMacBindRule argument, leading to a stack-based buffer overflow. The attack can be launched remotely.

Joomla Extension Modals Pro (regularlabs.com) versions < 17.0.0 contains a privileged stored XSS vulnerability via the event handler option. The extension supports JavaScript events such as on-open and on-closed but does not distinguish trusted configuration from event code supplied in article content. A lower-privileged author can use this feature to inject malicious code.

Joomla Extensions Snippets Free (< 7.0.0) and Snippets Pro (< 11.0.0) from regularlabs.com contain a privileged stored XSS vulnerability via the url option. Snippets substitutes variable values supplied by an article tag into saved Snippet content without considering the article author's trust level. A lower-privileged author can place an unsafe value into a security-sensitive position chosen by the trusted Snippet author.

Joomla extensions from regularlabs.com — Articles Anywhere < 20.0.0 and Users Anywhere < 2.1.0 (including Pro versions) — return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute, and a URL simultaneously, enabling reflected XSS.

Joomla Extension Articles Anywhere (regularlabs.com) versions < 20.0.0 contains a privileged stored XSS vulnerability via the link option. The extension accepts link options such as onclick and onmouseover, which in affected versions become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.