CVE Vulnerability Catalog

SAP NetWeaver Application Server ABAP and ABAP Platform in versions from 700 to 804 do not perform necessary authorization checks for an authenticated user, resulting in privilege escalation. This could allow an attacker to access sensitive information that can be used in a subsequent serious attack.

In SAP NetWeaver Process Integration versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, insufficiently encoded user-controlled inputs may lead to a Cross-Site Scripting (XSS) attack. Successful exploitation could impact the confidentiality and integrity of the system.

SAP Business One (Service Layer) version 10.0 allows an authenticated attacker with deep knowledge to perform certain operations to access unintended data over the network.

Under certain conditions, SAP Commerce API (OCC) in versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211 allows an attacker to access information that would otherwise be restricted. Successful exploitation could lead to a high impact on confidentiality.

SAP PowerDesigner version 16.7 queries all password hashes in the backend database and compares them with the user-provided one during login attempts. This may allow an attacker to access password hashes from the client's memory.

PrestaShop is an open source e-commerce application. Prior to version 8.1.1, it was possible to delete files from the server via the CustomerMessage API.

PrestaShop prior to version 8.1.1 allows for file deletion from the server using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue.

PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.

PrestaShop prior to version 8.1.1 has a vulnerability in the back office that allows file compromise through a path traversal attack. This can be achieved by replaying the import file deletion query with a specified file path that exploits this vulnerability.

ScanCode.io prior to version 32.5.1 has a command injection vulnerability in the docker fetch process. It allows appending malicious commands in the `docker_reference` parameter, leading to unauthorized command execution.

A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. The issue affects some unknown processing of the file ex_catagory_data.php, leading to SQL injection.

PrestaShop prior to version 8.1.1 had an SQL injection vulnerability in the product search field on the product page in the admin panel. Version 8.1.1 includes a patch for this issue.

Cryptomator version 1.9.2 allows local privilege escalation for low privileged users via the `repair` function in the MSI installer. The issue arises from the MSI's repair function spawning a SYSTEM Powershell without the `-NoProfile` parameter, leading to the loading of the user's profile.

A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[1][data] leads to SQL injection, which can be exploited remotely.

Versions 0.2.15, 0.2.16, and 0.3.0 of the Vyper language have a flaw in the allocation of named re-entrancy locks, allowing cross-function re-entrancy in contracts. Version 0.3.1 contains a fix for this issue.

Netgear DGN3500 version 1.1.00.37 was found to have a buffer overflow vulnerability via the http_password parameter in setup.cgi.

In the kadm_rpc_xdr.c library in MIT Kerberos 5 before 1.20.2 and 1.21.x before 1.21.1, there is a bug related to freeing an uninitialized pointer. A remote authenticated user can trigger a kadmind crash.

A critical vulnerability was found in SourceCodester Inventory Management System 1.0, affecting an unknown part of the file catagory_data.php. Manipulation of the argument columns[1][data] leads to SQL injection.

A vulnerability in Microsoft Edge (Chromium-based) allows for a security feature bypass. An attacker could exploit this flaw to gain access to protected resources.

CVE-2023-38045 describes an improper neutralization of input during web page generation in the oneVote component for Joomla, allowing Cross-site Scripting (XSS) targeting non-script elements.