CVE Vulnerability Catalog

An unauthenticated attacker can cause a Denial of Service (DoS) on the D-Link DSL-3782 router by sending a crafted HTTP request. The vulnerability exists in firmware version v1.01.

A NULL pointer dereference exists in Vim versions prior to 9.0.0240. It can be triggered by crafted input, causing the application to crash.

Frappe ERPNext version 12.29.0 is vulnerable to XSS attacks. The software does not neutralize or incorrectly neutralizes user-controllable input before placing it in output used as a web page served to other users.

Multiple reflected XSS vulnerabilities were found in BPC SmartVista version 3.28.0. These flaws occur when handling error messages, allowing an attacker to execute JavaScript code on the client side.

A buffer overflow vulnerability was discovered in the Tenda AC9 router firmware version V15.03.2.13 in the httpd process. The issue occurs in the form_fast_setting_wifi_set function, potentially allowing remote code execution.

The vulnerability in Mealie 1.0.0beta3 fails to terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.

A vulnerability in some Intel(R) Processors involves non-transparent sharing of return predictor targets between contexts. This may allow an authorized user to potentially enable information disclosure via local access.

A NULL pointer dereference exists in Vim versions prior to 9.0.0224. It can be triggered by crafted input, causing the application to crash.

An XSS (Cross-Site Scripting) vulnerability was discovered in rageframe2 version 2.6.37. The flaw exists in user agent related parameters on the info.php page.

Authenticated stored cross-site scripting (XSS) vulnerability in the "Field Server Address" field of INTELBRAS ATA 200 firmware version 74.19.10.21 allows attackers to inject JavaScript code through a crafted payload.

A vulnerability in the Linux kernel's dm-verity and LoadPin mechanisms allows users with root privileges to bypass verification by reloading the device-mapper table and switching the target to an equivalent dm-linear target. This allows root to load untrusted and unverified kernel modules and firmware, leading to arbitrary kernel execution and persistence for peripherals that do not verify firmware updates.

A Storage XSS vulnerability was discovered in EyouCMS version 1.5.8, allowing an attacker to execute arbitrary web scripts or HTML by injecting a special payload via the title parameter in the frontend contribution form.

A vulnerability in the VPN web client services component of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users. The issue is due to improper validation of input passed to the component before being returned to the browser. An attacker could exploit this by persuading a user to visit a website that sends malicious requests to an affected device with VPN web services enabled.

A vulnerability in Simcenter STAR-CCM+ exposes user, host, and display names when the Power-on-Demand public license server is used. An attacker can remotely retrieve this information.

A Cross-site scripting (XSS) vulnerability in the JSON search parse and response in eShop - Multipurpose Ecommerce Store Website version 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the get_products?search parameter.

Wykryto podatność typu Denial-of-Service w produktach F-Secure Atlant oraz niektórych produktach WithSecure, która może prowadzić do awarii silnika skanującego podczas analizy zniekształconych plików PE32-bit. Atakujący może zdalnie wywołać ten błąd.

In Moodle before versions 3.8.2, 3.7.5, 3.6.9, and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. The vulnerability can lead to excessive CPU resource consumption when processing specially crafted input.