CVE Vulnerability Catalog

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component is caused by a race condition between netlink control plane transaction and nft_set element garbage collection. Reference counter underflow leads to use-after-free, exploitable for local privilege escalation.

Wtyczka Simple Membership dla WordPressa jest podatna na odzwierciedlone ataki Cross-Site Scripting (XSS) poprzez parametr `list_type` w wersjach do 4.3.5 włącznie, z powodu niewystarczającej sanitizacji wejścia i ucieczki wyjścia. Atakujący bez uwierzytelnienia mogą wstrzykiwać dowolne skrypty webowe na strony, jeśli uda im się oszukać użytkownika do podjęcia akcji, takiej jak kliknięcie złośliwego linku.

Heap-based buffer overflow exists in the GitHub repository vim/vim prior to version 9.0.1873.

CVE-2023-3375 vulnerability in Unisign Bookreen allows unrestricted upload of files with dangerous types, leading to OS command injection. This issue affects Bookreen versions before 3.0.0.

A Use After Free vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1858. It may lead to undefined behavior, a crash, or potential code execution.

A Use After Free vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1857.

There is a Use After Free vulnerability in the GitHub repository vim/vim prior to version 9.0.1840.

Wtyczka Pixelgrade PixTypes w wersjach do 1.4.15 zawiera podatność na nieautoryzowane odzwierciedlone ataki typu Cross-Site Scripting (XSS). Atakujący może wykorzystać tę lukę do wstrzyknięcia złośliwego kodu JavaScript.

In the LTE protocol stack, there is a possible missing permission check, which could lead to remote information disclosure without the need for additional execution privileges.

In the NIA0 algorithm in Security Mode Command, there may be a missing verification of incorrect input. This could lead to remote information disclosure without the need for additional execution privileges.

A critical vulnerability has been identified in the TOTOLINK N200RE V5 9.3.5u.6437_B20230519 device, concerning the Validity_check function. The issue is related to format string manipulation, allowing for remote attack initiation.

There is a heap-based buffer overflow vulnerability in the GitHub repository vim/vim prior to version 9.0.1331.

ForeScout NAC SecureConnector version 11.2 has a vulnerability related to uncontrolled search path element, which may lead to unauthorized access to the system.

A 2017 Hyundai model has a vulnerability allowing authentication bypass via capture-replay attacks.

StarTrinity Softswitch version 2023-02-16 contains multiple CSRF vulnerabilities (CWE-352) that may allow attackers to perform unauthorized actions on behalf of users.

In version 2023-02-16 of StarTrinity Softswitch, there is an Open Redirect vulnerability that may lead to unauthorized redirection of users to malicious sites.

In version 2023-02-16 of StarTrinity Softswitch, there is a persistent XSS vulnerability (CWE-79) that may allow attackers to inject malicious JavaScript code into the application.

Version 2023-02-16 of StarTrinity Softswitch has multiple reflected XSS vulnerabilities (CWE-79). An attacker can exploit these vulnerabilities to inject malicious JavaScript code into server responses.

The vulnerability in 7Twenty BOT involves improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) attacks. An attacker can inject malicious JavaScript code that will be executed in users' browsers.