CVE Vulnerability Catalog

The issue was addressed with improved checks. Processing web content may lead to arbitrary code execution.

The issue was addressed with improved checks. A user may be able to elevate privileges.

The issue was addressed with improved checks. Processing a file may lead to unexpected app termination or arbitrary code execution.

ModSecurity 3.x before 3.0.10 has an issue with inefficient algorithmic complexity.

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information.

Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

A vulnerability in ASUS SetupAsusServices v1.0.5.1 within Asus Armoury Crate v5.3.4.0 is caused by an unquoted service path, allowing local users to launch processes with elevated privileges.

Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.

There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.

Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products.

Fujitsu Real-time Video Transmission Gear 'IP series' uses hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, resulting in termination of video transmission.

Armeria, a microservice framework supported by Spring, had an issue with handling matrix variables in versions prior to 1.24.3. As a result, Armeria decorators might not be invoked, allowing an attacker to bypass authorization by sending a specially crafted request.

Certifi, a collection of root certificates for SSL verification, prior to version 2023.07.22 recognized 'e-Tugra' root certificates. Following reports of security issues in 'e-Tugra' systems, these certificates were removed from the root store in version 2023.07.22.

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed.

Plexis Archiver prior to version 4.8.0 has a vulnerability that allows arbitrary file creation and potentially remote code execution during archive extraction. The issue occurs when extracting an archive that involves a symbolic link whose target does not exist.

DataEase is a data visualization analysis tool that prior to version 1.18.9 had a SQL injection vulnerability allowing bypass of blacklists. The vulnerability has been fixed in version 1.18.9.

Sentry is an error tracking and performance monitoring platform. In versions 8.21.0 through 23.5.2, an authenticated user could download a debug or artifact bundle from any organization and project with a known bundle ID, without needing permissions.