CVE Vulnerability Catalog

In Django versions 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are vulnerable to a ReDoS (regular expression denial of service) attack due to a very large number of domain name labels in emails and URLs.

The vulnerability arises from incomplete sanitization of zip file processing. It allows an authorized user to gain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.

A common injection vulnerability exists in the ESM certificate API, which may allow an unauthorized user to execute system command injection for the purpose of privilege escalation or to execute arbitrary commands.

Wtyczka Style Kits dla WordPressa jest podatna na atak typu Cross-Site Request Forgery w wersjach do 1.8.0 włącznie. Problem wynika z braku lub nieprawidłowej walidacji nonce w funkcji update_posts_stylekit().

An authentication bypass vulnerability in Intelbras Switch SG 2404 MR with firmware version 1.00.54 allows an unauthenticated attacker to download the device's backup file, exposing critical configuration information.

In the GitHub repository fossbilling/fossbilling prior to version 0.5.3, there is improper neutralization of formula elements in a CSV file.

In the GitHub repository fossbilling/fossbilling prior to version 0.5.3, there is an unrestricted upload of files with dangerous types.

Perimeter81 version 10.0.0.19 on macOS has a vulnerability that allows local privilege escalation to root via shell metacharacters in the usingCAPath parameter.

MISP version 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information due to the nature of the error messages.

Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs.

Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser.

Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device.

The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to and including 4.67. This allows user-controlled access to objects, enabling users to bypass authorization and access system resources.

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.

The Maxprint Maxlink 1200G device with firmware version v3.4.11E has an OS command injection vulnerability in the 'Diagnostic tool' functionality. This allows an attacker to execute arbitrary commands on the device.

The web interface of Gira KNX/IP-Router versions 3.1.3683.0 and 3.3.8.0 allows a remote attacker to read sensitive files via directory-traversal sequences in the URL.

An issue was discovered with the JSESSION IDs in Xiamen Si Xin Communication Technology Video management system versions 3.1 through 4.1 that allows attackers to gain escalated privileges.

Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system. In specific deployment scenarios, this allows the attacker to overwrite the configuration, which can be exploited to trigger Remote Code Execution (RCE).

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to and including 4.1.5. This is due to insufficient escaping on the supplied username value, allowing attackers with an existing account on a vulnerable WordPress instance to extract potentially sensitive information from the LDAP directory.

Versions of calamares-nixos-extensions up to 0.3.12 have an issue with storing the LUKS key in an unencrypted format in the `/boot` directory, which may lead to unauthorized access to user data. This affects non-UEFI systems and systems with a LUKS partition different from `/`.