CVE Vulnerability Catalog

A vulnerability was found in D-Link DCS-935L up to 1.10.01 in the SetDeviceSettings function of /web/cgi-bin/hnap/hnap_service. Manipulating the AdminPassword argument results in a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

XML::LibXML for Perl up to version 2.0210 reads out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 sequences. A node name ending in the middle of a multi-byte UTF-8 sequence causes reading past the end of the input string into adjacent heap memory.

Catalyst::Plugin::Statsd for Perl versions up to 0.10.0 may leak session IDs. If the communication channel to the statsd daemon is not secured (e.g., sending UDP packets to a host on another network), session IDs can be exposed.

Vulnerability in Aero CMS 0.0.1 allows authenticated attackers to inject PHP code by uploading malicious files via the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint.

Argus Surveillance DVR 4.0 has an unquoted service path vulnerability in the DVRWatchdog service, allowing local attackers to escalate privileges by placing a malicious executable in the Program Files directory.

memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting an excessively long character buffer into note fields. Attackers can generate a payload of 350000 repeated characters and paste it twice, causing a crash on iOS devices.

TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files via the file upload functionality. Attackers can upload a PHP shell via the Files section and execute commands by accessing the uploaded file with GET parameters passed to the system function.

WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wp_sap cookie parameter. Attackers can extract usernames, passwords, and other confidential data from the WordPress database.

Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into module parameters. Attackers can send POST requests to /manager/index.php with malicious PHP code in the 'post' parameter to create modules that execute arbitrary commands when invoked.

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the sat_code parameter. Attackers can authenticate, submit a POST request to /modules/system/admin.php?fct=autotasks&op=mod with crafted sat_code containing PHP commands, which creates an executable file that accepts arbitrary commands via GET parameters.

e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.

Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler. Attackers can send POST requests to the com_baforms component with malicious JSON in the 'id' parameter to execute arbitrary SQL queries.

Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the product_id parameter. Attackers can use time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc_user table.

EFM ipTIME A8004T router version 14.18.2 has a stack-based buffer overflow vulnerability in the formWifiBasicSet function in /goform/WifiBasicSet via manipulation of the security_5g argument. The attack can be performed remotely, and the exploit is publicly available.

Vulnerability in PHP (versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6) in the DOMNode::C14N() method causes incorrect XML processing, resulting in a circular linked list in the XML document's data structure. This may cause an infinite loop during subsequent processing, leading to denial of service (DoS).

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function uses a signed int variable to track the position in the input string. Passing a string longer than 2,147,483,647 bytes causes a signed integer overflow, leading to undefined behavior, out-of-bounds read, segmentation fault, and potential availability impact on the PHP process.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of a missing value element. This leads to dereferencing a NULL pointer, causing a segmentation fault, allowing a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, functions like urldecode() pass signed char to ctype functions (e.g., isxdigit()). On systems with default signed char and optimized table-lookup ctype functions (e.g., NetBSD), this can lead to array access with negative offset, potentially causing denial of service.