CVE Vulnerability Catalog

Potential vulnerabilities in the BIOS for some HP PC products may allow an attacker to cause denial of service.

Potential vulnerabilities in the BIOS for some HP PC products may allow an attacker to cause denial of service.

Potential vulnerabilities in the BIOS for some HP PC products may allow an attacker to cause denial of service.

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members. This allows remote authenticated users with the site member role to add and duplicate forms via the UI or the API.

A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to execute arbitrary HTML scripts via a crafted payload in the content field of a blog post.

A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.

A memory leak vulnerability exists in the PerimeterGenerator class of Slic3r libslic3r version 1.3.0 and Master Commit b1a5500. Specially crafted STL files can exhaust available memory.

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a JavaScript payload in the file name.

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an INPUTRC environment variable to locate its config file, and when it cannot parse the specified file, it prints an error message containing data from that file. This allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

A flaw was found in the s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. A local attacker with special user privileges can circumvent the verifier, potentially leading to a confidentiality problem.

In Expat (also known as libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Core FTP/SFTP Server v2 Build 725 was found to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packet sent through the SSH service.

In JerryScript, an assertion failure occurs in the parser_parse_function_arguments function in js/js-parser.c, potentially causing the JavaScript interpreter to crash.

Potential security vulnerabilities including compromise of integrity and allowed communication with untrusted clients have been identified in HP Support Assistant software.

In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. This can cause a kernel crash (denial of service).

The check_alu_op() function in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a pointer leak.

OCS Inventory 2.9.1 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this by manipulating the name of a device (e.g., a printer) on the victim's computer, replacing it with malicious code.

A persistent cross-site scripting (XSS) vulnerability was discovered in the XMPie UStore application version 12.3.7244.0 in the administrative panel when editing users. The vulnerability exists in two input fields, allowing injection of malicious scripts.

A reflected cross-site scripting (XSS) vulnerability exists in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta. A remote unauthenticated attacker can execute code on the victim's device by sending a crafted URL to the victim.