CVE Vulnerability Catalog

The vulnerability in Consensys Discovery versions prior to 0.4.5 uses the same AES/GCM nonce for the entire session, while it should be unique for every message. The node's private key is not compromised, only the session key generated for specific peer communication is exposed.

DependencyCheck for Maven 9.0.0-9.0.6, CLI 9.0.0-9.0.5, and Ant 9.0.0-9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allow unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and versions earlier than 1.9.0 incorrectly validate some invalid ECDSA signatures. This could lead to acceptance of forged signatures.

Cross-site scripting vulnerability in MolecularFaces before 0.3.0 allows a remote attacker to execute arbitrary JavaScript in the victim's browser via crafted molfiles.

Multiple reflected XSS vulnerabilities were found in nasSvr.php of actiNAS-SL-2U-8 version 3.2.03-SP1. They allow remote attackers to inject arbitrary web script or HTML.

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. Guests with local user privileges can trigger a deadlock and potentially crash the system.

A Cross-Site Scripting (XSS) vulnerability was found in ABO.CMS version 5.9.3. The flaw allows an attacker to execute arbitrary JavaScript code via a crafted Referer header.

In the Linux kernel, the blkgs destruction path in block/blk-cgroup.c causes a cgroup blkio memory leak. A circular dependency prevents freeing blkcg and blkgs after they are offline, potentially leading to system instability like out-of-memory errors.

The vulnerability in the Hozard alarm system v1.0 involves sending an identical radio frequency signal for each request, allowing an attacker to perform replay attacks and disarm the alarm.

A Stored XSS vulnerability in the Email Encoder plugin for WordPress (up to version 2.1.9) via the eeb_mailto shortcode. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.

A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.

A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'name' parameter on the Profile and Exclusion List pages.

A Cross-Site Scripting (XSS) vulnerability was found in NetScout nGeniusOne version 6.3.4. It allows a remote attacker to execute arbitrary code via the 'creator' parameter on the Alert Configuration page.

A vulnerability in httparty before version 0.21.0 allows an attacker to manipulate filenames during multipart/form-data uploads. A remote, unauthenticated attacker can provide a crafted filename parameter, leading to the writing of attacker-controlled filenames.

Cross-site scripting vulnerability in govuk_tech_docs versions 2.0.2 through before 3.3.1. Malicious JavaScript may be executed in the user's browser when a crafted search result is displayed.

Stored XSS vulnerability in TinyMCE before version 5.6.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.

An XSS vulnerability in TinyMCE before version 5.10.0 allows a remote, unauthenticated attacker to inject malicious JavaScript via crafted image or link URLs. The code executes in the browser of a user editing content.

Stored XSS vulnerability in TinyMCE before version 5.9.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.

A cross-site scripting (XSS) vulnerability exists in the admin_ Video.php component of SeaCMS v12.8. It allows attackers to execute arbitrary web scripts or HTML via a crafted payload.