CVE Vulnerability Catalog

Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.

Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physical proximity to the original device.

A vulnerability in Keystone, an open source headless CMS for Node.js, allows public access to the `adminMeta` GraphQL query when `ui.isAccessAllowed` is set to `undefined`. This differs from the default behavior of the AdminUI middleware, which requires a session if a session strategy is defined.

A vulnerability was found in phpRecDB version 1.3.1 that allows cross site scripting (XSS) attacks through manipulation of the r/view argument in the /index.php file. The issue has been rated as problematic.

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. A user could store such rows that are forbidden by UPDATE and SELECT policies but not by INSERT policies.

Mattermost fails to delete the attachments when deleting a message in a thread, allowing a simple user to still access and download the attachment of a deleted message.

An out-of-bounds write in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Business logic errors in the GitHub repository froxlor/froxlor prior to version 2.0.22 and 2.1.0 may lead to unauthorized access or improper application behavior.

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

CVE-2023-37511 concerns improper App Transport Security (ATS) settings that can lead to insecure loading of web content. If configured incorrectly, applications may be vulnerable to security attacks.

Nextcloud Server provides data storage for the Nextcloud cloud platform. In versions from 24.0.4 to 25.0.8, 26.0.3, and 27.0.0, users could add images inline into text files and download them, even if the folder containing the images did not have download permissions.

Nextcloud Server, an open source cloud platform, has a vulnerability that allows unauthenticated users to send DAV requests revealing the existence of a calendar or address book for a given identifier. The issue affects versions from 25.0.0 to 25.0.8, 26.0.0 to 26.0.3, and 27.0.0 to 27.0.0.

The Notes app in Nextcloud, from version 4.4.0 to 4.8.0, has an issue where HTML file content is rendered in the preview instead of being offered for download.

The user_oidc module, which provides the OIDC connect backend for Nextcloud, has a vulnerability that allows an attacker to impersonate the Nextcloud server if they gain at least read access to a snapshot of the database. The issue exists in versions from 1.0.0 to 1.3.2, and version 1.3.3 contains a patch.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, an authenticated remote attacker with admin privileges can read hardcoded cryptographic keys, allowing the attacker to create valid session cookies.

FFRI yarai products and their OEM versions handle exceptional conditions improperly, which may lead to a denial-of-service (DoS) condition. This affects multiple versions of FFRI yarai and related products.

Dangerzone is software for converting potentially dangerous files into safe PDFs. In versions prior to 0.4.2, if the container is compromised, an attacker may spoof messages in the user's terminal or change the window title.

A vulnerability has been identified in Parasolid and Teamcenter Visualization applications affecting versions prior to specified ones. The issue involves stack exhaustion while parsing a specially crafted X_T file, which could lead to a denial of service condition.

A vulnerability has been identified in Parasolid and Teamcenter Visualization applications, present in versions earlier than specified. The issue involves null pointer dereference while parsing specially crafted X_T files, which could allow an attacker to execute code in the context of the current process.