CVE Vulnerability Catalog

There is a code injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name.

XWiki Platform has a XSS vulnerability that allows users to inject JavaScript through forged URLs. An example URL can execute an `alert` command in the browser, potentially leading to unauthorized access to user data.

The vulnerability in the Elenos ETG150 FM transmitter running version 3.12 stems from improper access control, allowing the addition of a high-privilege user by exploiting the user's role within the admin profile. The attack can be carried out over the public internet in some cases.

A use-after-free flaw was found in mt7921_check_offload_capability in the Linux Kernel's mt76/mt7921 component. This flaw could allow an attacker to crash the system after 'features' memory release.

Improper access control in Elenos ETG150 FM transmitter version 3.12 allows privilege escalation by exploiting user roles in the user profile. The attack can be carried out over the public internet in some cases.

XWiki Platform, from version 7.3-milestone-1 to versions 14.4.8, 14.10.6, and 15.1, allows access to obfuscated passwords via REST API, even when email obfuscation is enabled. The issue has been patched in versions 14.4.8, 14.10.6, and 15.1.

XWiki Platform has a vulnerability related to email obfuscation configuration. In versions from 3.5-milestone-1 to 14.4.8, 14.10.4, and 15.0-rc-1, server responses contained unobfuscated email addresses, allowing users to read them.

An unauthenticated Time-Based SQL injection was found in Webkul QloApps version 1.6.0 via GET parameters date_from, date_to, and id_product. This allows a remote attacker to bypass the web application's authentication and authorization mechanisms and retrieve the contents of an entire database.

LibreDWG versions 0.11 to 0.12.5 were found to contain a heap buffer overflow in the function bit_write_TF in bits.c.

Version 0.12.5 of LibreDWG was found to contain a heap buffer overflow vulnerability in the function bit_calc_CRC in bits.c.

Versions of LibreDWG from 0.10 to 0.12.5 were found to contain a heap buffer overflow vulnerability in the function bit_utf8_to_TU in bits.c.

LibreDWG versions 0.10 to 0.12.5 were found to contain a heap buffer overflow in the function bit_wcs2nlen at bits.c.

In the GitHub repository admidio/admidio prior to version 4.2.9, there is improper neutralization of formula elements in a CSV file.

The Andy Moyle Church Admin plugin versions up to 3.7.29 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.