CVE Vulnerability Catalog

A security vulnerability has been detected in Tenda CH22 up to 1.0.0.1. This issue affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset, where manipulation of the mit_ssid_index argument leads to a stack-based buffer overflow. The attack may be initiated remotely and the exploit has been disclosed publicly.

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload field. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is executed in the context of other users when they generate an Annual Report. Successful exploitation allows the administrative user to perform actions on behalf of the target, including stealing session cookies, user credentials, or sensitive data.

A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the photo argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.

W systemie zarządzania salonem piękności PHPGurukul w wersji 1.1 odkryto lukę bezpieczeństwa. Manipulacja argumentem delid w pliku /admin/invoices.php prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie zarządzania salonem piękności PHPGurukul w wersji 1.1 zidentyfikowano podatność. Manipulacja argumentem delid w pliku /admin/customer-list.php prowadzi do możliwości wykonania ataku typu SQL injection.

A vulnerability was determined in GNU Binutils 2.45 in the function get_link_hash_entry of the file bfd/elflink.c of the Linker component. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed. Upgrading to version 2.46 addresses this issue.

A vulnerability was found in GNU Binutils 2.45 in the function elf_link_add_object_symbols in bfd/elflink.c of the Linker component. The manipulation results in an out-of-bounds read. The attack requires local access. The exploit has been made public and could be used. Upgrading to version 2.46 addresses the issue.

A vulnerability has been found in GNU Binutils 2.45 in the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the Linker component. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc.

A flaw has been found in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the firstname argument leads to SQL injection. The attack can be executed remotely and the exploit is public; other parameters might also be affected.

In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).

Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, which is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe, yt-dlp.exe, or yt-dlp_x86.exe.

A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0 affecting /index.php. Manipulation of the voter argument results in SQL injection. Remote exploitation is possible and the exploit is now public.

A security vulnerability has been detected in D-Link DI-7001 MINI (version 24.04.18B1). The affected element is an unknown function of the file /dbsrv.asp. Manipulation of the str argument leads to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.

W klasie MediaConnector projektu vLLM występuje podatność typu Server-Side Request Forgery (SSRF). Metody load_from_url i load_from_url_async pobierają i przetwarzają media z adresów URL podanych przez użytkowników, nie wprowadzając odpowiednich ograniczeń na docelowe hosty.

ION-DTN 4.1.3s contains a vulnerability involving uncontrolled memory allocation when processing a BPv7 bundle with a malformed extension block, leading to receiver thread termination and DoS. The issue is due to a conversion of block length from unsigned int to signed int, causing an attempt to allocate an unrealistic amount of memory.

Nagios Log Server before 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though the API response indicates it could not be stopped.