CVE Vulnerability Catalog

A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.

Cargo versions from 1.60.0 to 1.72 did not escape Cargo feature names in reports generated by `cargo build --timings`, potentially allowing for malicious HTML injection. A malicious package included as a dependency could inject JavaScript, creating cross-site scripting risks.

In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in 'card fields' is not properly escaped. Agile dashboard administrators can be forced to execute uncontrolled code by deleting a kanban with a malicious label.

In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, the preview of an artifact link does not respect project, tracker, and artifact level permissions. Users might gain access to information they should not have access to.

A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Service (DoS) via supplying crafted WMA files when connecting a device to the vehicle's USB plug and play feature.

An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.

An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but is not fully configured for SNAP PAC S1 Firmware version R10.3b.

The FTP port is open by default in SNAP PAC S1 Firmware version R10.3b, which could allow unauthorized users to access some device files.

DedeCMS versions up to and including 5.7.110 contain a cross-site scripting (XSS) vulnerability in /dede/freelist_edit.php via the title parameter.

DedeCMS versions up to and including 5.7.110 contain a cross-site scripting (XSS) vulnerability in /dede/freelist_add.php via the title parameter.

DedeCMS versions up to and including 5.7.110 were found to contain multiple cross-site scripting (XSS) vulnerabilities in /dede/vote_edit.php via the votename and votenote parameters.

DedeCMS versions up to and including 5.7.110 were found to contain multiple cross-site scripting (XSS) vulnerabilities in /dede/vote_add.php triggered by the votename and voteitem1 parameters.

The OpenSSH implementation in IBM AIX 7.2, 7.3, and VIOS 3.1 may allow a non-privileged local user to access files that should be restricted due to improper access controls.

In Spring for Apache Kafka versions 3.0.9 and earlier and 2.9.10 and earlier, a possible deserialization attack vector exists, but only if unusual configuration is applied. An attacker would need to construct a malicious serialized object in one of the deserialization exception record headers.

Wireshark versions 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 have a memory leak in the BT SDP dissector, allowing denial of service via packet injection or crafted capture files.

Wireshark versions 4.0.0 to 4.0.6 contain a bug in the CBOR dissector that can lead to application crashes. An attacker can exploit this via packet injection or a crafted capture file to cause denial of service.

Wireshark versions 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 contain a vulnerability in the BT SDP dissector that can lead to an infinite loop. An attacker can exploit this flaw through packet injection or by crafting a malicious capture file.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized data disclosures.

The vulnerability in CP-Plus DVR is due to improper input validation within the web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.