CVE Vulnerability Catalog

An issue was discovered in FRRouting FRR through 9.0, where bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

An issue in Pagekit version 1.0.18 allows a remote attacker to execute arbitrary code via the downloadAction and updateAction functions in UpdateController.php.

Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component.

Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet.

Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbitrary code via the yr_execute_cod function in the exe.c component.

Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.

Versions of pf4j up to 3.9.0 contain a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.

Versions of pf4j up to 3.9.0 have a vulnerability that allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.

Version 3.1.2 of Perfree PerfreeBlog contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted plugin listed in admin/plugin/access/list.

An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.

Versions of Zoho ManageEngine Active Directory 360 and other products are vulnerable to 2FA bypass using certain TOTP authenticators. A valid pair of username and password is required to leverage this vulnerability.

A vulnerability in the CPIO command of Busybox v1.33.2 allows attackers to perform a directory traversal. The issue stems from improper handling of file paths when extracting CPIO archives.

CVE-2023-40590 affects the GitPython library, which can execute a malicious `git` program from a local repository if the user runs GitPython from that directory. This issue primarily occurs on Windows systems where Python improperly resolves paths to executables.

In PHPJabbers Car Rental Script version 3.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920 related to improper handling of PPP length parameter inconsistency, which can cause an infinite loop.

Sliver from versions 1.5.x to 1.5.39 has an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses.

CVE-2023-40195 involves deserialization of untrusted data in the Apache Airflow Spark Provider, allowing authorized users to execute arbitrary code on the Airflow node by pointing to a malicious Spark server.

Saho's attendance devices ADM100 and ADM-100FP have a vulnerability of missing authentication for critical functions. An unauthenticated remote attacker can execute system commands in partial website URLs to read sensitive device information without permissions.

IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

A vulnerability in Microsoft Edge (Chromium-based) allows for elevation of privilege, potentially leading to unauthorized access to the system.