CVE Vulnerability Catalog

Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.

ShowMojo MojoBox Digital Lockbox version 1.4 is vulnerable to authentication bypass. The lock opening mechanism via Bluetooth Low Energy (BLE) is susceptible to replay attacks, allowing a malicious user to open the lock.

Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.

A vulnerability was found in Samba's mdssvc RPC service that leads to an infinite loop. The issue occurs when parsing RPC packets sent by the client, where an unvalidated field can lead to 100% CPU usage.

The InfoDoc Document On-line Submission and Approval System lacks sufficient restrictions on the available tags within its HTML to PDF conversion function, allowing unauthenticated attackers to load remote or local resources through HTML tags such as iframe.

Weintek Weincloud version 0.13.6 may allow an attacker to abuse the registration functionality to log in with testing credentials to the official website.

In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. This could be exploited to load a DLL with SYSTEM privileges.

Weintek Weincloud version 0.13.6 could allow an attacker to reset a password using the corresponding account’s JWT token.

Weintek Weincloud version 0.13.6 could allow an attacker to cause a denial-of-service condition by sending a forged JWT token.

In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to improper path validation, which could result in local privilege escalation or a denial-of-service condition.

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Feathersjs, a framework for creating web APIs and real-time applications, has an issue with handling invalid string conversion errors. This bug can cause the NodeJS process to crash when sending an unexpected Socket.io message.

CVE-2023-3467 vulnerability allows privilege escalation to the system administrator level (nsroot). This can lead to unauthorized access to critical system resources.

CVE-2023-3466 is a vulnerability related to reflected Cross-Site Scripting (XSS) attacks, which may allow attackers to inject malicious scripts into a web page. Users visiting the compromised page could be exposed to data theft or other unauthorized actions.

A use-after-free vulnerability exists in Foxit Reader 12.1.2.15332 related to handling the destruction of annotations. Maliciously crafted Javascript code in a PDF document can trigger reuse of a previously freed object, leading to memory corruption and potential arbitrary code execution.

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution.

Grav, a file-based web platform built in PHP, is vulnerable to a server side template injection (SSTI) attack. Version 1.7.42 and later have a flaw in the `isDangerousFunction()` which allows the execution of malicious code by prepending a double backslash (`\`).

An issue was discovered in goproxy v1.1 that can lead to a Denial of Service (DoS) via unspecified vectors.

Version 1.01 of the D-LINK DIR-815 router has a buffer overflow vulnerability in the /web/captcha.cgi component.

1Panel, an open source Linux server management panel, has an OS command injection vulnerability in its firewall functionality. A specially crafted HTTP request can lead to arbitrary command execution on the target system.