CVE Vulnerability Catalog

A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.

The vulnerability in Mealie 1.0.0beta3 fails to terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.

A vulnerability in some Intel(R) Processors involves non-transparent sharing of return predictor targets between contexts. This may allow an authorized user to potentially enable information disclosure via local access.

A NULL pointer dereference exists in Vim versions prior to 9.0.0224. It can be triggered by crafted input, causing the application to crash.

An XSS (Cross-Site Scripting) vulnerability was discovered in rageframe2 version 2.6.37. The flaw exists in user agent related parameters on the info.php page.

Authenticated stored cross-site scripting (XSS) vulnerability in the "Field Server Address" field of INTELBRAS ATA 200 firmware version 74.19.10.21 allows attackers to inject JavaScript code through a crafted payload.

A vulnerability in the Linux kernel's dm-verity and LoadPin mechanisms allows users with root privileges to bypass verification by reloading the device-mapper table and switching the target to an equivalent dm-linear target. This allows root to load untrusted and unverified kernel modules and firmware, leading to arbitrary kernel execution and persistence for peripherals that do not verify firmware updates.

A Storage XSS vulnerability was discovered in EyouCMS version 1.5.8, allowing an attacker to execute arbitrary web scripts or HTML by injecting a special payload via the title parameter in the frontend contribution form.

A vulnerability in the VPN web client services component of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users. The issue is due to improper validation of input passed to the component before being returned to the browser. An attacker could exploit this by persuading a user to visit a website that sends malicious requests to an affected device with VPN web services enabled.

A vulnerability in Simcenter STAR-CCM+ exposes user, host, and display names when the Power-on-Demand public license server is used. An attacker can remotely retrieve this information.

A Cross-site scripting (XSS) vulnerability in the JSON search parse and response in eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.

Wykryto podatność typu Denial-of-Service w produktach F-Secure Atlant oraz niektórych produktach WithSecure, która może prowadzić do awarii silnika skanującego podczas analizy zniekształconych plików PE32-bit. Atakujący może zdalnie wywołać ten błąd.

In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. The vulnerability can lead to excessive CPU resource consumption when processing specially crafted input.

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Niewystarczające egzekwowanie polityki w DevTools w Google Chrome na systemie Windows przed wersją 103.0.5060.53 umożliwia atakującemu, który przekonał użytkownika do zainstalowania złośliwego rozszerzenia, uzyskanie potencjalnie wrażliwych informacji z lokalnych plików użytkownika za pomocą spreparowanej strony HTML.

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.