CVE Vulnerability Catalog

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. An attacker can bypass authentication using a forged JWT token.

A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

In the bitbank2 AnimatedGIF library v2.2.0, a buffer overflow in the DecodeLZW function allows remote attackers to cause a crash or potentially execute arbitrary code via a crafted GIF file.

Shenzhen Kangda Xin Intelligent Network Technology's router DR300 (version 2.1.2.121) contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. This allows attackers to read/write memory, modify firmware, inspect active connections, and view connected devices.

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious scripts into form fields, which execute in the victim's browser, potentially hijacking their account or session.

FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.

In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.

Azure Stack Edge has a vulnerability involving external control of file name or path, allowing an unauthorized attacker to execute code over a network.

An integer overflow or wraparound vulnerability in Windows HTTP.sys allows an unauthorized attacker to execute code remotely over a network.

Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

A use-after-free vulnerability in the Windows Kernel allows an unauthorized attacker to execute code remotely over a network.

A vulnerability in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network. No CWE identifier is assigned for this issue.

A stack-based buffer overflow in the Windows DHCP Client allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.

A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.

The vulnerability in OpenSSL involves improper processing of AuthEnvelopedData containers in CMS, where insufficient validation of cipher and tag length fields allows an attacker to replace the cipher with an unauthenticated one (e.g., AES-256-OFB) or reduce the tag length to a single byte. This can lead to key-equivalent functionality for a chosen recipient and bypass of message integrity.

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

CBS Platform from MOSK Information Technologies Ltd. is vulnerable to SQL injection due to improper neutralization of special elements. The product is unsupported.