CVE Vulnerability Catalog

CVE-2023-37220 affects Synel terminals that download code without integrity checks. This could lead to the execution of malicious software on user devices.

A heap-based buffer overflow vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1848.

An untrusted search path vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1833.

An out-of-bounds write vulnerability exists in the GitHub repository vim/vim prior to version 9.0.1847.

An integer overflow or wraparound exists in the GitHub repository vim/vim prior to version 9.0.1846.

A vulnerability has been identified in MXsecurity versions prior to v1.0.1, which may put the confidentiality and integrity of SSH communications at risk on the affected device. This issue is due to a hard-coded SSH host key, which might facilitate man-in-the-middle attacks and enable the decryption of SSH traffic.

A vulnerability has been discovered in MXsecurity versions prior to v1.0.1 that allows for unauthorized access. This issue arises from inadequate authentication measures, potentially leading to the disclosure of device information by a remote attacker.

A vulnerability has been identified in MXsecurity versions prior to v1.0.1 that allows unauthorized disclosure of authenticated information. This issue arises from improper neutralization of special elements, allowing remote attackers to alter SQL commands.

In Ubuntu's accountsservice, there is a use-after-free vulnerability that can be exploited by an unprivileged local attacker by sending a D-Bus message to the accounts-daemon process.

The open source library @dcl/single-sign-on-client, used for handling single sign-on authentication flows, contains an input validation vulnerability in the `init` function, allowing arbitrary JavaScript to be executed using the `javascript:` prefix.

An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components.

O-RAN Software Community ric-plt-lib-rmr version 4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device.

CVE-2023-40968 describes a buffer overflow vulnerability in version 1.5.1 and earlier of the hzeller timg library, allowing a remote attacker to cause a denial of service.

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.

SSRF vulnerability in NebulaGraph Studio version 3.7.0 allows remote attackers to send requests from the server to internal resources, potentially leading to disclosure of sensitive information.

The Dharmesh Patel Post List With Featured Image plugin versions <= 1.2 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The Chop-Chop Coming Soon plugin versions up to 2.2.4 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The ShopConstruct plugin versions up to 1.1.2 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the user's browser context.

Senayan Library Management Systems SLIMS version 9.6.1 is vulnerable to SQL Injection via loan_rules.php in the admin module.

Certain Lexmark devices (such as CS310) before August 25, 2023, are vulnerable to XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246 or higher to remediate the vulnerability.