CVE Vulnerability Catalog

In Versa Analytics, cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.

vFairs 3.3 is affected by Remote Code Execution. Any logged-in user can abuse the profile picture upload functionality to place a malicious PHP file on the server and gain code execution.

SQL injection vulnerability in vFairs 3.3 allows any logged-in user to inject malicious SQL queries into the API. An attacker can manipulate the database of the conference or event.

In Trusted Firmware-M up to version 1.3.0, improper memory management during cryptographic operations can lead to a memory leak in case of operation failure.

BMC Remedy 9.1SP3 is affected by an authenticated code execution vulnerability. Authenticated users with report creation rights can use BIRT templates to execute arbitrary code.

In GNU LibreDWG version 0.10, a vulnerability was found involving overlapping memory areas in the memcpy function. The issue occurs in the read_2004_section_header function in decode.c. It may allow remote code execution.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10 in the bit_read_RC function in bits.c. An attacker could exploit this to execute arbitrary code or cause a system crash.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10. The issue occurs in the read_2004_section_revhistory function at src/decode.c:3051.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10. The issue occurs in the read_2004_section_handles function in decode.c, potentially leading to crashes or arbitrary code execution.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10 in the bit_read_B function in bits.c at line 135. This flaw can be exploited by an attacker to execute arbitrary code.

A heap-based buffer overflow vulnerability exists in GNU LibreDWG version 0.10 via the bit_search_sentinel function in ../../src/bits.c:1985. This flaw allows out-of-bounds memory writes.

A heap buffer overflow vulnerability exists in GNU LibreDWG version 0.10 in the read_2004_section_appinfo function at ../../src/decode.c:2842. The flaw occurs when processing specially crafted DWG files.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10. The issue occurs in the read_2004_section_preview function in decode.c, potentially leading to crashes or arbitrary code execution.

A heap-based buffer overflow vulnerability exists in GNU LibreDWG version 0.10 in the read_2004_section_classes function at decode.c:2440. This flaw can be exploited by an attacker to execute arbitrary code or cause a denial of service.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10 in the read_2004_compressed_section function at ../../src/decode.c:2417. This issue can lead to unexpected program behavior.

A heap-based buffer overflow vulnerability exists in GNU LibreDWG version 0.10 in the bit_calc_CRC function in bits.c. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a system crash.

A heap-based buffer overflow vulnerability was found in GNU LibreDWG version 0.10 in the read_2004_compressed_section function in decode.c at line 2379. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.

In InvoicePlane 1.5.11, a misconfigured web server allows an unauthenticated attacker to list directories and download files that should be private via directory traversal.