CVE Vulnerability Catalog

nnn is vulnerable to an out-of-bounds write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious session file in the victim's nnn session directory can exploit this to corrupt adjacent global state. Only version 5.2 was tested and confirmed as vulnerable.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low-privileged attacker with remote access could exploit it, leading to script injection.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS command injection vulnerability. A high-privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS command injection vulnerability. A low-privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise versions prior to 4.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could exploit it, leading to information exposure.

An issue in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter.

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter.

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than comparing the full data. This allows an attacker with physical write access to boot media to forge modified SPL images that pass secure boot verification without the OEM signing key. Each forgery attempt succeeds with approximately 2/3 probability.

The Ingenic T41 (and probably also T32, T40, A1) SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code.

Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0.

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environment.

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1.

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.

Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.