CVE Vulnerability Catalog

Traggo Server version 0.3.0 is vulnerable to directory traversal via a crafted GET request.

Interactsh is an open-source tool for detecting out-of-band interactions. Versions of the interactsh server prior to 1.0.0 were vulnerable to subdomain takeover for the `app` subdomain, allowing attackers to run arbitrary client-side code in users' browsers.

Guantang Equipment Management System version 4.12 is vulnerable to Arbitrary File Upload.

A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. A local attacker with user access can escalate privileges.

An attacker can capture an authenticating hash and utilize it to create new sessions. The hash is also a poorly salted MD5 hash, which could result in a successful brute force password attack.

A vulnerability was found in libX11 due to a lack of checks on values passed to functions in src/InitExt.c. These values are used as array indexes, which can lead to overwriting other parts of the Display structure, potentially causing the client to crash due to memory corruption.

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation.

CVE-2023-3090 describes a heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver that can be exploited for local privilege escalation.

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). An attacker can exploit this vulnerability to inject malicious code into server templates.

A stack overflow in the UpdateSnat function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the UpdateMacClone function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the AddWlanMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the Edit_BasicSSID_5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the UpdateWanParams function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A vulnerability in the hardware-based SSL/TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause an unexpected reload, resulting in a denial of service (DoS). This is due to an implementation error in cryptographic functions when offloaded to hardware. An attacker could exploit this by sending a crafted stream of SSL/TLS traffic.

The open source framework AWS data.all in versions 1.2.0 through 1.5.1 does not prevent remote code execution when a user injects Python commands into the 'Template' field while configuring a data pipeline. The issue can only be triggered by authenticated users.

A stack overflow in the UpdateWanMode function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the EditWlanMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the EditMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

A stack overflow in the AddMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.