CVE Vulnerability Catalog

Array AG OS versions before 9.4.0.499 allow denial of service, where remote attackers can cause system service processes to crash through abnormal HTTP operations.

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.

An issue was discovered in TechView LA-5570 Wireless Gateway version 1.0.19_T53, allowing attackers to gain sensitive information via /config/system.conf.

OWASP Coraza WAF, a modsecurity compatible web application firewall library, crashes due to misuse of `log.Fatalf`. The application crashes immediately after receiving crafted requests from attackers, triggered by an error in `mime.ParseMediaType`.

A vulnerability in the ironic-image container image allows access to the Ironic API without authentication if it is not deployed with TLS and does not have API and Conductor split into separate services. If there is no firewall, the API could be accessed by anyone on the network.

In the go-libp2p library, using signed peer records, a malicious actor can store an arbitrary amount of data in a remote node's memory. This memory is not garbage collected, which can lead to memory exhaustion and node crashes.

Freighter is a Chrome extension for Stellar that may be vulnerable to an attack from a malicious website, allowing access to the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the recovery phrase.

Notepad++ versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution.

Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access.

An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey component.

CVE-2023-36198 describes a buffer overflow vulnerability in version 1.9.0 of the sgxwallet by skalenetwork, allowing an attacker to cause a denial of service via the trustedBlsSignMessage function.

In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability.

In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authentication stack overflow vulnerability.

Version 22.6.529.216 of the Phicomm K2 device contains a command injection vulnerability via the luci.sys.call function.

Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the ssid parameter.

The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.

The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulnerability in Tenda AC23 v16.03.07.45_cn.

M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 have a path traversal issue that allows authenticated users to read some restricted files on the web server.

AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.

A Regular expression Denial-of-Service (ReDoS) vulnerability exists in multiple add-ons for Mailform Pro CGI version 4.3.1.3 and earlier. An unauthenticated remote attacker can cause a denial-of-service condition.