CVE Vulnerability Catalog

The IC Realtime ICIP-P2012T camera version 2.420 is vulnerable to incorrect access control via an exposed HTTP channel using VLC network. This allows unauthorized access to the video stream.

Wtyczka Go Pricing - WordPress Responsive Pricing Tables jest podatna na wstrzyknięcie obiektów PHP w wersjach do 3.3.19 włącznie, poprzez deserializację niezaufanego wejścia z parametru 'data' shortcode 'go_pricing'. Umożliwia to uwierzytelnionym atakującym z uprawnieniami na poziomie subskrybenta i wyżej wstrzyknięcie obiektu PHP.

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz, often outside the range of human adult hearing.

IC Realtime ICIP-P2012T camera version 2.420 has an incorrect access control vulnerability. It allows unauthenticated users to access device ports.

The Introduction Client in Briar through version 1.5.3 does not implement out-of-band verification for the public keys of introducees. This allows an attacker to launch man-in-the-middle attacks against later private communication between two introduced parties.

Bramble Synchronisation Protocol (BSP) in Briar before 1.4.22 allows attackers to cause a denial of service through a series of long messages to a contact, resulting in repeated application crashes.

Insecure permissions in MobileTrans v4.0.11 allow attackers to escalate privileges to local admin by replacing the executable file.

A vulnerability in the Armoli Technology Cargo Tracking System allows authorization bypass through a user-controlled key, leading to authentication abuse.

Wtyczka Go Pricing - WordPress Responsive Pricing Tables dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewłaściwej weryfikacji uprawnień w funkcji 'validate_upload' w wersjach do 3.3.19 włącznie. Umożliwia to uwierzytelnionym atakującym, którym administrator wcześniej przyznał dostęp do wtyczki, przesyłanie dowolnych plików na serwer dotkniętej witryny.

Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.

AList w wersji 3.15.1 jest podatny na błędne zarządzanie dostępem, co może być wykorzystane przez atakujących do uzyskania poufnych informacji.

A memory leak in the CConsole::Chain component of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) by opening a crafted file.

A vulnerability in the Finex Media Competition Management System allows unauthorized actors to access private personal information and collect data provided by users.

CVE-2023-2702 vulnerability in Finex Media Competition Management System allows authorization bypass through a user-controlled key, leading to authentication abuse.

An OS Command Injection vulnerability was found in Parks Fiberlink 210 firmware version V2.1.14_X000 via the target_addr parameter in /boaform/admin/formPing.

A command injection vulnerability exists in the Linksys E2000 router with firmware version 1.0.06. An attacker with web management privileges can inject commands into POST request parameters in the httpd Start_EPI() function, gaining shell access.

A command injection vulnerability exists in the Linksys E2000 router with firmware version 1.0.06. An attacker with web management privileges can inject commands into the POST request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.

A command injection vulnerability exists in the Linksys WRT54GL router with firmware version 4.30.18.006. An attacker with web management privileges can inject commands into POST request parameters in the httpd's Start_EPI() function, gaining shell access.

MXsecurity version 1.0 is vulnerable to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, allowing attackers with authorization privileges to break out of the restricted shell and execute arbitrary code.

Bitcoin Core before version 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) due to inefficient draining of the inventory-to-send queue, as exploited in the wild in May 2023.