CVE Vulnerability Catalog

The Premium Addons PRO plugin for Elementor versions <= 2.8.24 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

A directory traversal vulnerability in FME Server before version 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, leading to unauthorized reading and writing of arbitrary files.

Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.

Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.

The YARP (Yet Another Reverse Proxy) vulnerability allows for a Denial of Service (DoS) attack, potentially leading to service unavailability.

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Buffer overflow was discovered in TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3, and TL-WR941ND V5/V6 in the component /userRpm/QoSRuleListRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlAccessTargetsRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

Devices TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were found to have a buffer read out-of-bounds vulnerability in the /userRpm/VirtualServerRpm component. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

Devices TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 have a buffer overflow vulnerability in the component /userRpm/AccessCtrlTimeSchedRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

FLVMeta v1.2.1 was found to contain a buffer overflow in the xml_on_metadata_tag_only function at dump_xml.c.

Version 0.4.7 of the libming library was found to contain a buffer overflow in the parseSWF_DEFINEFONTINFO() function in parser.c.

TOPdesk version 12.10.12 has an XML Signature Wrapping (XSW) vulnerability in the SAML-based Single Sign-on feature. This allows bad actors with credentials to authenticate with the Identity Provider and impersonate any TOPdesk user via SAML Response manipulation.

Advantech R-SeeNet version 2.4.22 allows low-level users to access and load the content of local files.

An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.