CVE Vulnerability Catalog

Harman Infotainment version 20190525031613 and later discloses the IP address via CarPlay CTRL packets.

Harman Infotainment version 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle using a password that is an internal project name.

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or delete arbitrary database records.

Vulnerability in the window management module related to permission control. Successful exploitation of this vulnerability may lead to malicious pop-up windows.

Potential buffer overflow vulnerabilities exist in several locations within the Zephyr project's source code, particularly in files related to USB handling.

A buffer overflow vulnerability in the cFilenameInit parameter of the browseForDoc function in Foxit PDF Reader 10.1.0.37527 allows local attackers to cause a denial of service (DoS) via a crafted PDF file.

CVE-2023-3937 describes a cross site scripting vulnerability in the web portal of Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows. It allows an authenticated user with high privileges to trigger an XSS attack via the web browser.

Mattermost fails to sanitize post metadata during audit logging, resulting in permalinks contents being logged.

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Mattermost fails to check if the requesting user is a guest, allowing guests to view, join, edit, export, and archive public playbooks.

Improper authentication vulnerability in Genians Genian NAC and Genians Genian ZTNA allows authentication abuse. This affects versions from V4.0.0 to V4.0.155 and from V5.0.0 to V5.0.54.

A protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for Linux may allow an authenticated user to potentially enable escalation of privilege via local access.

Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

An NTLM Hash Disclosure was discovered in ArchiMate before version 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource.

Zoho ManageEngine Applications Manager through version 16530 allows reflected XSS while logged in.

MISP version 2.4.174 allows XSS in app/View/Events/index.ctp.

In the OpenZeppelin Contracts library, versions from 4.0.0 to 4.9.2 have an issue where the `_msgSender` method may return `address(0)` for calls originating from a trusted forwarder with calldata shorter than 20 bytes. This issue has been patched in version 4.9.3.

In Netbox version 3.4.7, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Custom Link templates.