CVE Vulnerability Catalog

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitize uploaded .mkp files (Extension Packages), allowing remote code execution. Exploitation requires access to the management interface with valid credentials or a hijacked admin session.

The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) has a misconfiguration of the default Dokuwiki web app, allowing embedded PHP code. This leads to remote code execution. Exploitation requires access to the management interface with valid credentials or a hijacked admin session.

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit a crafted POST request to perform unauthorized actions on behalf of an authenticated user.

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

A vulnerability in zlib before version 1.2.12 allows memory corruption during data compression when the input contains many distant matches.

Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.

Wtyczka Ninja Forms - File Uploads dla WordPressa jest podatna na refleksyjny atak typu cross-site scripting z powodu braku sanitizacji parametru nazwy pliku w pliku ~/includes/ajax/controllers/uploads.php. Atakujący bez uwierzytelnienia mogą wykorzystać tę lukę do dodania złośliwych skryptów do podatnych witryn WordPress, w wersjach do 3.3.12 włącznie.

Wtyczka Amelia do WordPressa jest podatna na ataki Cross-Site Scripting z powodu niewystarczającego oczyszczania i sanitizacji parametru lastName w pliku ~/src/Application/Controller/User/Customer/AddCustomerController.php. Umożliwia to atakującym wstrzykiwanie dowolnych skryptów webowych na stronach, które są wykonywane, gdy użytkownik uzyskuje dostęp do kalendarza rezerwacji z datą, w którą atakujący wstrzyknął złośliwy ładunek.

IrfanView 4.59 is vulnerable to a buffer overflow in the function at address 0x413c70 (in the 32-bit version). The vulnerability is triggered when the user opens a malicious TIFF image.

A buffer overflow vulnerability exists in the blocking.cgi script of ASUS AC68U routers version 3.0.0.4.385.20852 and earlier. This flaw can lead to a denial of service (DoS).

A heap buffer overflow in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c allows a local attacker with normal privileges to overwrite kernel heap objects, potentially leading to local privilege escalation.

A vulnerability in BigAnt Server version 5.6.06 allows an attacker to perform a Denial of Service (DoS) attack, potentially causing service disruption.

BigAnt Server version 5.6.06 from BigAnt Software was found to contain a Cross-Site Request Forgery (CSRF) vulnerability. This allows an attacker to perform unauthorized actions on behalf of an authenticated user.

BigAnt Server version 5.6.06 is vulnerable to directory traversal attacks, allowing an attacker to read files outside the server's root directory.

BigAnt Server version 5.6.06 was found to have incorrect access control issues. This vulnerability may allow unauthorized users to access resources without proper permissions.

BigAnt Server version 5.6.06 was found to have incorrect access control. This vulnerability may allow unauthorized users to access resources without proper permissions.

An issue was discovered in MISP before version 2.4.156, where app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF attacks.

An issue was discovered in MISP before version 2.4.156 that allows Local File Inclusion via the custom terms file setting in app/View/Users/terms.ctp.