CVE Vulnerability Catalog

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Incorrect Authorization vulnerability that could lead to a Security feature bypass. A low-privileged attacker could leverage this vulnerability to access other user's data.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, an authenticated remote attacker with admin privileges can read hardcoded cryptographic keys, allowing them to decrypt an encrypted web application login password.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote attacker with low privileges can gain limited read-access to the device-filesystem through a configuration dialog within the embedded Qt browser.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote attacker with low privileges can gain limited read-access to the device-filesystem within the embedded Qt browser.

The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to and including 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration.

CVE-2023-38752 describes an improper authorization vulnerability in the Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7, allowing authorized API users to view attribute information of posters marked as 'non-disclosure'.

CVE-2023-38751 describes an improper authorization vulnerability in versions 4.4.0 to 4.7.7 of the Special Interest Group Network for Analysis and Liaison, allowing authorized API users to view organization information set as 'non-disclosure' in the information provision operation.

OpenTelemetry Java Instrumentation prior to version 1.28.0 has an issue related to the instrumentation of Java applications using AWS SDK v2 with Amazon Simple Email Service (SES) v1 API. When instrumenting POST requests to SES, query parameters are inserted into the `url.path` field, leading to the email content being present in telemetry metadata.

The Zoom Client SDK for Windows before version 5.15.0 has cleartext storage of sensitive information, which may allow an authenticated user to enable information disclosure via local access.

Improper input validation in Zoom Desktop Client for Windows before version 5.15.5 may allow an authenticated user to enable information disclosure via network access.

An issue was discovered in Samsung NFC S3NRN4V, S3NSN4V, S3NSEN4, SEN82AB, and S3NRN82 related to buffer copying without checking input size, which can cause an NFC service restart.

Alteryx Server 2022.1.1.42590 does not verify uploaded file types. This flaw allows attackers to upload arbitrary files (e.g., JavaScript for stored XSS) via the 'type' field in a JSON document in a PUT /gallery/api/media request.

The social-media-skeleton project, implemented using PHP, MySQL, CSS, JavaScript, and HTML, has a stored XSS vulnerability in versions 1.0.0 to 1.0.3. The issue is patched in version 1.0.3.

A vulnerability in ASP.NET Core SignalR and Visual Studio allows for information disclosure. An attacker could exploit this flaw to gain access to sensitive data.

Users of jackson-dataformats-text for parsing TOML data may be vulnerable to Denial of Service (DOS) attacks. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to stack overflow.

In Zoom clients before version 5.14.10, there is a client-side enforcement issue of server-side security that may allow a privileged user to enable information disclosure via network access.

Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.

A vulnerability in Microsoft Message Queuing (MSMQ) allows attackers to remotely trigger a fault, leading to denial of service. Exploiting this flaw may cause the MSMQ service to stop responding to requests.

A vulnerability in Azure Apache Hadoop allows attackers to spoof other services, potentially leading to unauthorized access to data.

A vulnerability in the Windows Smart Card Resource Management Server allows for a security feature bypass. An attacker could exploit this flaw to gain access to functions that should be protected.