CVE Vulnerability Catalog

CVE-2023-36835 is a vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX10000 Series that allows a network-based attacker to cause a Denial of Service (DoS). Receiving a specific valid IP packet that needs to be routed over a VXLAN tunnel results in a PFE wedge condition, impacting traffic.

CVE-2023-36832 is a vulnerability in Juniper Networks' Junos OS on MX Series devices that allows an unauthenticated attacker to send specific packets to an AMS interface, causing the packet forwarding engine (PFE) to crash and resulting in a Denial of Service (DoS). Continued processing of these packets can lead to a sustained DoS condition.

In the getLocationCache method of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.

CVE-2023-36831 describes an improper check or handling of exceptional conditions vulnerability in the UTM Web-Filtering feature of Juniper Networks Junos OS. This issue leads to a jbuf memory leak when accessing certain websites, potentially resulting in a Denial of Service (DoS) condition.

There is a SQL Injection vulnerability in the GitHub repository pimcore/pimcore prior to version 10.5.24.

Improper Privilege Control in RazerCentralService in RazerCentral <=7.11.0.558 on Windows allows a local malicious actor to gain SYSTEM privilege by communicating with the named pipe as a low-privilege user and calling 'AddModule' or 'UninstallModules' command to execute arbitrary executable file.

Improper Privilege Control in RazerCentralService in RazerCentral versions <=7.11.0.558 on Windows allows a malicious actor with local access to gain SYSTEM privilege via communicating with the named pipe as a low-privilege user and triggering an insecure .NET deserialization.

Thymeleaf through 3.1.1.RELEASE, used in spring-boot-admin through 3.1.1, allows sandbox bypass via crafted HTML. This may lead to SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

In the GitHub repository froxlor/froxlor prior to version 2.0.21, there is improper encoding or escaping of output.

Auto-GPT is an experimental open-source application that had a vulnerability in the `execute_python_code` command before version 0.4.3, allowing for a path traversal attack. This enables overwriting .py files outside the workspace directory, potentially leading to arbitrary code execution on the host.

Auto-GPT versions prior to 0.4.3 have a vulnerability that allows the docker-compose.yml file in the container to be overwritten, potentially leading to control over the host system. This issue has been patched in version 0.4.3.

Version 4.0.0-6 of issabel-pbx contains a vulnerability that allows a remote attacker to obtain sensitive information via the modules directory.

The vulnerability in Envoy related to the HTTP/2 codec may lead to memory structure leaks upon receiving `RST_STREAM` and `GOAWAY` frames from an upstream server. A flaw in the cleanup code causes a memory leak, potentially leading to denial of service.

A vulnerability in mx-chain-go, the official implementation of the MultiversX blockchain protocol, allowed for the sender account nonce of an inner transaction to be increased if the inner transaction failed. This could lead to a limited DoS attack on a targeted account.

A vulnerability in DELICIA application version 13.6.1 by DERICIA Co. Ltd allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function.

A vulnerability in the Marui Official app version 13.6.1 allows a remote attacker to access sensitive information via the channel access token in the Marui Official Store miniapp function.

An issue found in ALBIS Co. ALBIS version 13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS function.

Umbraco, an ASP.NET CMS, can under rare conditions allow unauthorized users access to admin-level permissions after a restart. This vulnerability was patched in versions 10.6.1, 11.4.2, and 12.0.1.

An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.

A vulnerability in Entetsu Store version 13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.