CVE Vulnerability Catalog

In IAS Canias ERP 8.03, the iasGetServerInfoEvent function in the RMI Interface component allows remote manipulation leading to improper authorization. The exploit has been publicly disclosed.

A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. The function resolveSkillScriptPath in src/kernel.ts of the System Command Handler component allows OS command injection. The exploit is publicly available.

A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the component UPF. This manipulation causes improper access controls. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The vendor was contacted early about this disclosure.

SQL Injection vulnerability in CodeAstro Online Catering Ordering System 1.0. Manipulation of the ID argument in /deleteorder.php allows remote SQL injection.

An OS command injection vulnerability was found in Wavlink NU516U1 240425 in the sys_login1 function of /cgi-bin/login.cgi. Manipulating the ipaddr argument allows remote command execution. The exploit has been published.

An OS command injection vulnerability was detected in Wavlink NU516U1 240425 in the WifiBasic function of /cgi-bin/wireless.cgi. Manipulating arguments AuthMethod/EncrypType allows remote command execution. The exploit is publicly available.

A security vulnerability has been detected in Wavlink NU516U1 240425. The function advance in the file /cgi-bin/wireless.cgi is affected by OS command injection via manipulation of arguments wlan_conf, Channel, skiplist, or ieee_80211h. The attack can be launched remotely and the exploit has been disclosed.

An OS command injection vulnerability was identified in Wavlink NU516U1 240425 in the wzdapMesh function of /cgi-bin/adm.cgi. The attack can be performed remotely. The exploit has been made public.

A vulnerability was discovered in Open5GS up to version 2.7.7 in the function ogs_pcc_rule_install_flow_from_media in the library /lib/proto/types.c. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.

A vulnerability was discovered in Open5GS up to version 2.7.7 in the function pcf_npcf_smpolicycontrol_handle_delete in the file src/pcf/sm-sm.c in the delete Endpoint component. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference and denial of service. Exploitable when user input influences the encoding passed to mb_regex_encoding().

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, an attacker can craft a URL that causes arbitrary JavaScript execution (XSS) on the target's machine when viewing the PHP-FPM status page.

In Open5GS up to version 2.7.7, a vulnerability exists in the function pcf_sess_set_ipv6prefix in file /src/pcf/context.c of the PCF component. Manipulation of the argument SmPolicyContextData.ipv6AddressPrefix can lead to denial of service (DoS). The attack can be launched remotely, and the exploit has been publicly disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the pcf_sess_sbi_discover_and_send function of the sm-policies Endpoint component. Input manipulation can lead to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.

Open5GS up to version 2.7.7 has a vulnerability in the pcf_nbsf_management_handle_register function in src/pcf/nbsf-handler.c of the sm-policies Endpoint component. Input manipulation leads to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.

A security vulnerability has been found in Industrial Application Software IAS Canias ERP 8.03 in the RMI interface. The Runtime.getRuntime.exec function allows OS command injection via the troiaCode argument. The attack can be performed remotely and the exploit has been made public.

Path traversal vulnerability in the RMI interface of Canias ERP 8.03. Manipulation of the m_strSourceFileName argument in the iasRequestFileEvent function allows remote attack.

Vulnerability in IAS Canias ERP 8.03 in the RMI Interface component, where manipulation of the sessionId argument in the doAction function leads to improper authentication. Remote attack possible, exploit publicly available.

In OSGeo gdal up to version 3.13.0dev-4, a vulnerability exists in the function GDSDfldsrch in file frmts/hdf4/hdf-eos/GDapi.c of the Grid File Handler component. Manipulation leads to a heap-based buffer overflow. The attack must be local. The exploit has been disclosed. Upgrading to version 3.13.0RC1 resolves the issue.

A flaw has been found in OSGeo gdal up to version 3.13.0dev-4. The function SWSDfldsrch in file frmts/hdf4/hdf-eos/SWapi.c is affected. Manipulation can lead to a heap-based buffer overflow. The attack requires local access. The exploit has been published and may be used. Upgrading to version 3.13.0RC1 addresses this issue.