CVE Vulnerability Catalog

CVE-2023-37218 affects the Tadiran Telecom Aeonix system and involves improper limitation of a pathname to a restricted directory, potentially leading to a 'Path Traversal' attack. An attacker could gain access to files outside the allowed directory.

In the AnaSystem SensMini M4 device, an authenticated user can cause a Denial of Service using the configuration tool.

CVE-2023-37213 affects Synel SYnergy fingerprint terminals, which are vulnerable to 'OS Command Injection' attacks. An attacker can exploit this vulnerability to execute unauthorized system commands.

Apache NiFi versions 0.0.2 through 1.22.0 include processors and controller services that support HTTP URL references for retrieving drivers, allowing an authenticated and authorized user to configure a location that enables custom code execution.

In Google Chrome prior to version 114.0.5735.90, there was a vulnerability related to out of bounds read and write in ANGLE, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page.

In CODESYS Development System versions 3.5.9.0 to 3.5.17.0 and CODESYS Scripting versions 4.0.0.0 to 4.1.0.0, unsafe directory permissions allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users.

A critical vulnerability has been found in SourceCodester Online Jewelry Store 1.0, affecting unknown code in the login.php file. Manipulation of the username/password arguments leads to SQL injection, which can be executed remotely.

An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5, where an app may be able to bypass certain Privacy preferences.

This issue was addressed by removing the vulnerable code. An app may be able to modify protected parts of the file system.

A logic issue was addressed with improved restrictions. Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 16.6, iPadOS 16.6, watchOS 9.6, tvOS 16.6, and macOS Ventura 13.5.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in several versions of Apple operating systems.

The issue concerns improper validation of symlinks, which may allow an app to bypass user privacy preferences. It has been fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, and macOS Ventura 13.5.

TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 suffers from cleartext storage of sensitive information: RSA private key in Update.exe.

A directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to access sensitive information by manipulating file paths.

Tolgee is an open-source localization platform that has a vulnerability in versions 3.14.0 to 3.23.1, where the backend fails to verify the permission scopes associated with the API key, allowing permission checks to be bypassed for some endpoints. This issue only affects projects that have inadvertently exposed their API keys on the internet.

DietPi-Dashboard has a vulnerability that allows an attacker to lock the dashboard in a state waiting for a TLS handshake, preventing legitimate traffic from accessing it. This issue exists in version 0.6.1 and has been patched in version 0.6.2.

Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7, an attacker can send a virtual request that will cause the node process to crash.

In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of packages, allowing attackers to tamper with them undetected. The issue has been fixed in versions 1.11.5, 1.12.3, and 1.13.0.

A vulnerability in the Kirby content management system related to insufficient session expiration affects versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. It allows attackers to remain logged in to a Kirby site even after the user has changed their password.

A vulnerability in the Kirby content management system allows attackers with content write access to overwrite fields that should not be modified. This issue affects versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6, and its exploitation could lead to altering site content or injecting malicious data.