CVE Vulnerability Catalog

A flaw exists in bfd_pef_parse_function_stubs of bfd/pef.c in binutils versions prior to 2.34. An attacker able to submit a crafted file processed by objdump can cause a NULL pointer dereference.

A flaw exists in bfd_pef_scan_start_address() of bfd/pef.c in binutils. An attacker able to submit a crafted file processed by objdump can cause a NULL pointer dereference.

A flaw exists in binutils /bfd/pef.c. An attacker able to submit a crafted input file processed by objdump can cause a NULL pointer dereference.

A flaw in binutils /opcodes/tic4x-dis.c causes the use of uninitialized memory when processing a crafted input file. The highest threat is to application availability, with a lower threat to data confidentiality. The flaw affects binutils versions prior to 2.34.

A heap buffer overflow exists in binutils in bfd/pef.c when a crafted PEF file is parsed by objdump, leading to an out-of-bounds read. The flaw affects binutils versions prior to 2.34.

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Profile Page. An attacker can inject a malicious JavaScript payload into the 'Admin Full Name' field, which triggers every time the admin visits the profile page.

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is vulnerable to cross-site scripting (XSS) in the Admin Panel - Manage User tab via the Full Name field. An attacker can inject a malicious JavaScript payload during user registration, which triggers when the admin visits the manage user section, potentially stealing session cookies.

Invision Community 4.5.4 is affected by a cross-site scripting (XSS) vulnerability in the Field Name field. An attacker can inject a malicious JavaScript payload that executes whenever a user opens that field.

WonderCMS 3.1.3 is vulnerable to cross-site scripting (XSS) in the Admin Panel. An attacker can inject a malicious JavaScript payload in the Page keywords field, which triggers on every visit to the website, allowing theft of session cookies.

CoasterCMS version 5.8.18 is vulnerable to Cross-Site Scripting (XSS). An attacker can steal a user's session cookie and redirect them to a malicious website, as the vulnerability is triggered on the main home page of the application.

DotCMS Add Template with admin panel 20.11 is affected by stored Cross-Site Scripting (XSS) that allows an attacker to steal cookies and gain remote privileges. This compromises the security of the web application.

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by the p11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.

XStream before 1.4.15 is vulnerable to arbitrary file deletion on the local host during unmarshalling. A remote attacker can delete known files if the process has sufficient rights by manipulating the processed input stream.

XStream before 1.4.15 contains a Server-Side Request Forgery (SSRF) vulnerability activated during unmarshalling. A remote attacker can request data from internal resources not publicly available by manipulating the processed input stream.

In OpenAsset Digital Asset Management (DAM) version 12.0.19 and earlier, access controls are missing on the /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to access potentially sensitive project information stored by the application.

OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.

OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.

Vulnerability in Firefox for Android related to the Remote Debugging via USB feature, which was enabled on Android versions prior to 6.0. Untrusted apps could connect to the feature and operate with browser privileges to read and interact with web content.

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Affects Firefox < 83.