CVE Vulnerability Catalog

Bouncy Castle for Java before version 1.74 is affected by an LDAP injection vulnerability. This vulnerability affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates, where the certificate's Subject Name is inserted into an LDAP search filter without proper escaping.

A critical vulnerability was found in SmartWeb Infotech Job Board version 1.0, affecting some unknown functionality of the file /settings/account in the My Profile Page component. Manipulation of the argument filename leads to unrestricted file uploads.

A critical vulnerability has been found in SourceCodester Shopping Website 1.0, related to an unknown functionality of the file insert-product.php. Manipulation of this functionality leads to unrestricted file uploads.

A critical vulnerability was found in SourceCodester Shopping Website version 1.0, affecting an unknown function in the file search-result.php. Manipulation of the argument 'product' leads to SQL injection.

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.

All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with the document, such as the password.

Affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. An attacker with 'user' privileges could access files requiring higher privileges by establishing an SSH session and providing the other tokens.

Affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values.

Maxsite CMS version 108.7 has a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.

A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.

Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

Affected TBox RTUs store hashed passwords using MD5 encryption, which is considered insecure.

Knowage is a professional open source suite for data analytics that has a vulnerability in versions 6.x.x and prior to 8.1.8. It allows authenticated users to download template files, but the lack of sanitization of the '_templateName_' parameter enables attackers to download any file from the system.

An out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to version 114.0.5735.90 allowed a local attacker to perform denial of service via physical access to the device.

2FA is a web application for managing Two-Factor Authentication (2FA) accounts and generating security codes. Cross site scripting (XSS) injection can be performed via the account/service field.

An unquoted Windows search path vulnerability existed in the install service of MOVE 4.10.x and earlier versions. The misconfiguration allowed an unauthorized local user to insert arbitrary code into the unquoted service path, leading to privilege escalation and the ability to stop antimalware services.

A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.

Gradle has a path traversal vulnerability when unpacking Tar archives, which may lead to overwriting important files in locations where the Gradle process has write permissions. An attacker can exploit this flaw by controlling the source of an archive or modifying the build to interact with a malicious archive.