CVE Vulnerability Catalog

An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statements.

An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

A vulnerability in the scaffolder-backend plugin of the Backstage platform allows for remote code execution by a malicious actor with access to a registered template. The issue arises from the use of a templating library that requires a sandbox, which permits code injection.

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine.

The Robin Wilson bbp style pack plugin versions <= 5.5.5 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

Wtyczka RapidLoad Power-Up dla Autoptimize w wersjach do 1.6.35 zawiera podatność na wstrzykiwanie SQL (SQLi) związaną z autoryzacją (subscriber+). Atakujący może wykorzystać tę lukę do wykonania nieautoryzowanych zapytań do bazy danych.

The WooCommerce Bulk Stock Management plugin versions <= 2.2.33 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. An attacker can inject malicious formulas into CSV files exported from the system, potentially leading to code execution on the victim's side.

Wtyczki Abandoned Cart Lite dla WooCommerce oraz Abandoned Cart Pro dla WooCommerce w WordPress są podatne na przechowywane ataki Cross-Site Scripting (XSS) poprzez wiele parametrów w wersjach do 5.1.3 i 7.12.0. Problem wynika z niewystarczającej sanitizacji danych wejściowych oraz ucieczki danych wyjściowych.

The urlnorm crate through version 0.1.4 for Rust is vulnerable to a Denial of Service (DoS) attack via a crafted URL. The supplier disputes this vulnerability, claiming that 'slow printing of URLs is not a CVE.'

Podatność związana z niewłaściwą walidacją danych wejściowych w demonie protokołu routingu (rpd) systemu Junos OS firmy Juniper Networks pozwala nieautoryzowanemu atakującemu zdalnemu na spowodowanie odmowy usługi (DoS). Problem występuje, gdy wiadomość aktualizacji BGP zawiera określony, opcjonalny atrybut transytywny, co prowadzi do zerwania sesji BGP.

An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API.

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary administrative commands.

A regression in the fix for bug 66512 in Apache Tomcat causes that if a response does not include any HTTP headers, no AJP SEND_HEADERS message will be sent. This leads to at least one AJP proxy (mod_proxy_ajp) using the response headers from the previous request, resulting in an information leak.

A critical vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It affects an unknown functionality of the file /admin/reg.php of the Admin Registration component, leading to improper authentication.

The John Brien WordPress NextGen GalleryView plugin versions <= 0.5.5 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.