CVE Vulnerability Catalog

A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

CVE-2023-3333 describes an improper neutralization of special elements used in OS commands vulnerability in NEC Corporation Aterm devices, allowing an attacker to execute arbitrary OS commands with root privileges after obtaining high privileges by exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service.

CVE-2023-34395 describes improper neutralization of argument delimiters in a command in the Apache Airflow ODBC Provider. This allows for privilege escalation through controllable ODBC driver parameters, leading to arbitrary command execution.

Weak password requirements exist in the GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to version 1.2.0.

A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a particular log file which may contain sensitive information regarding the product.

A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.

A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.

A vulnerability related to an exposed dangerous function in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.

A vulnerability in Trend Micro Apex One and Apex One as a Service due to an untrusted search path could allow a local attacker to escalate their privileges on affected installations.

CVE-2023-34144 describes an untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent that could allow a local attacker to escalate their privileges on affected installations.

A use after free vulnerability in Guest View in Google Chrome prior to version 114.0.5735.198 allows an attacker who convinces a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

A use after free vulnerability in Media in Google Chrome prior to version 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Type Confusion in V8 in Google Chrome prior to version 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The H3C Magic B1STW B1STV100R012 device was found to contain a stack overflow in the SetAPInfoById function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

DataEase is a data visualization analysis tool that in affected versions allows unauthorized users to delete an application. This vulnerability has been fixed in version 1.18.8.

An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA that allows read-only access to specific files.

A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.

A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.

Versions Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via the session expiration function.