CVE Vulnerability Catalog

Excelize versions 2.3.1 to 2.11.0 perform insufficient structural and parameter validation before using attacker-controlled values in slicing, indexing, allocation, and division. A malformed OLE file can trigger unrecovered Go runtime panics, terminating the process.

Excelize versions 2.1.0 to 2.11.0 in Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. A crafted worksheet with an oversized row number causes iteration through all missing rows, consuming CPU.

The Disable and Remove Google Fonts WordPress plugin through 2.0.2 is vulnerable to Reflected XSS due to improper neutralization of input during web page generation.

The Unlimited Elements For Elementor WordPress plugin through 2.0.19 is vulnerable to deserialization of untrusted data, allowing object injection.

Reflected XSS vulnerability in Everest Forms plugin. Improper input neutralization during web page generation allows an attacker to inject malicious script that executes in the victim's browser. Affects versions from n/a through 3.6.1.

Stored XSS vulnerability in Unlimited Elements For Elementor plugin. Improper input neutralization during web page generation allows persistent injection of malicious script that executes on every page view. Affects versions from n/a through 2.0.19.

Vulnerability in Docker Engine regarding incorrect classification of a registry as insecure. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default, and isCIDRMatch returns true if any host address matches. An attacker can use a DNS answer with a loopback IP and an attacker IP to disable certificate verification and enable HTTP fallback.

Vulnerability in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) related to insufficient protection against code injection (CWE-94). Discovered during an internal security review, addressed in software hardening releases.

Vulnerability in Cisco networking software related to improper neutralization of special elements (CWE-74). Discovered during an internal security review, addressed in software hardening releases.

Vulnerability in Cisco networking software related to incorrect calculation issues (CWE-682). Discovered during an internal security review, addressed in a software hardening release.

A vulnerability discovered during Cisco's internal security review concerns insufficient control flow management (CWE-691). It is addressed in a software hardening release. Impact details are not provided in the description.

A vulnerability found during Cisco's internal security review concerns improper input validation (CWE-20). It is addressed in a software hardening release. No impact details are given.

A vulnerability discovered by Cisco's security review concerns improper control of a resource through its lifetime (CWE-664). It is fixed in a software hardening release.

A vulnerability found during Cisco's internal security review concerns improper access control (CWE-284). It is addressed in a software hardening release.

A vulnerability in Cisco NX-OS found during security review concerns improper handling of exceptional conditions (CWE-703). It is addressed in a software hardening release.

A vulnerability in Cisco NX-OS discovered during internal security review concerns out-of-bounds read (CWE-125). It is fixed in a software hardening release.

A vulnerability in Cisco NX-OS discovered during security review concerns improper input validation of special elements in a command (CWE-20). It is addressed in a software hardening release.

A vulnerability in Cisco NX-OS discovered during internal security review concerns improper neutralization (CWE-707). It is fixed in a software hardening release.

Homer, open source telecom observability software, before version 11.0.283 is vulnerable to SQL injection in the V4StatisticsQuery handler. The user-supplied rawquery field is passed directly to DuckDB without calling sqlvalidator.ValidateRawSQL, allowing any authenticated user to execute arbitrary SQL statements against all data accessible via the FlightSQL service.

A vulnerability in the web-based management interface of Cisco Finesse is due to improper input validation for specific HTTP requests. An unauthenticated, remote attacker could send a crafted HTTP request to conduct server-side request forgery (SSRF) attacks. A successful exploit could allow the attacker to obtain limited sensitive information for services associated with the affected device.