CVE Vulnerability Catalog

jfinal CMS version 5.1.0 has an arbitrary file read vulnerability.

xlsxio versions from 0.1.2 to 0.2.34 contain a flaw related to an uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.

The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection.

Vulnerability in HUAWEI VR screen projection related to undefined permissions. Successful exploitation of this vulnerability allows third-party apps to create windows arbitrarily, leading to resource consumption.

Podatność CVE-2023-23841 dotyczy oprogramowania SolarWinds Serv-U, które wysyła żądanie HTTP podczas zmiany lub aktualizacji atrybutów dla udostępniania plików lub żądania plików. Część adresu URL żądania ujawnia wrażliwe dane.

RedTeam Pentesting discovered that the web interface of STARFACE and its REST API allow authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database is generally considered best practice, this becomes ineffective in this case.

The snappy-java library has a flaw related to unchecked chunk length that can lead to a critical error in versions prior to 1.1.10.1. The hasNextChunk function does not validate the chunkSize variable, which can result in a NegativeArraySizeException or OutOfMemoryError.

A cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76 and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Grav is a flat-file content management system. In versions prior to 1.7.42, there was a server-side template injection vulnerability that allowed remote code execution by not blocking certain built-in functions exposed by Twig.

Grav is a flat-file content management system. In versions prior to 1.7.42, the denylist was insufficient, allowing low privileged attackers to inject malicious templates and achieve remote code execution.

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function that allows validation against a denylist of unsafe functions to be skipped when an array is passed as an argument. This enables a low privileged attacker with login access to the Grav Admin panel and page creation/update permissions to inject malicious templates and obtain remote code execution.

Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the parser_parse_for_statement_start in js-parser-statm.c.

Jerryscript 3.0 (commit 05dbbd1) was found to contain an Assertion Failure in the ecma_property_hashmap_create function, which may lead to unexpected application behavior.

Contiki-NG is an operating system for IoT devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_input_storing` function, the system does not verify that the packet buffer is large enough, which can lead to out-of-bounds reads.

An issue was discovered in jjson through version 0.1.7 that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies.

An issue was discovered in Ujcms v6.0.2 that allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip.

An issue was discovered in htmlcleaner thru version 2.28 that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies.

An issue was discovered in jtidy thru r938 that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies.

An issue was discovered in hjson through version 3.0.0 that allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

Version genson through 1.6 has an issue that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that use cyclic dependencies.