CVE Vulnerability Catalog

Klasa HTMLSectionSplitter w wersji 0.3.8 biblioteki langchain-text-splitters jest podatna na ataki XML External Entity (XXE) z powodu niebezpiecznego parsowania XSLT. Podatność ta wynika z możliwości użycia dowolnych arkuszy stylów XSLT, które są parsowane bez odpowiednich zabezpieczeń.

W systemie Uniclare Student Portal v2 zidentyfikowano podatność na wstrzykiwanie SQL. Umożliwia ona zdalnym atakującym wstrzykiwanie dowolnych poleceń SQL przez podatne pola wejściowe, co pozwala na wykonanie funkcji opóźnienia czasowego w celu wnioskowania o odpowiedziach bazy danych.

W projekcie Student Crud Operation 3.3 wykryto podatność bezpieczeństwa w nieznanej funkcji pliku delete.php. Manipulacja argumentem ID prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

A SQL injection vulnerability was found in code-projects Online Course Registration 1.0 in /admin/edit-course.php. Manipulating the coursecode argument allows remote exploitation. The exploit has been publicly disclosed.

The vulnerability in Akka.Remote (versions 1.2.0 to 1.5.51) is the lack of mutual TLS (mTLS) — the outbound-connecting client is not required to present its certificate, allowing untrusted parties to join an Akka.NET cluster even when TLS is enabled. The issue is fixed in version 1.5.52, which enforces mTLS by default and introduces fail-fast semantics for missing or invalid private keys.

Flag Forge versions starting from 2.0.0 and prior to 2.3.2 had the `/api/admin/badge-templates` (GET) and `/api/admin/badge-templates/create` (POST) endpoints accessible without authentication or authorization. This allowed unauthorized users to retrieve all badge templates and sensitive metadata and/or create arbitrary badge templates in the database. The issue is fixed in version 2.3.2.

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This can result in PHP's call stack limit being exceeded and/or increased memory consumption, potentially leading to denial of service. Version 1.0.0 contains a patch.

A Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information.

A Cross Site Scripting (XSS) vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware version 6010-0076-000 Ver 4.00. This flaw allows an attacker to inject malicious scripts, potentially leading to the theft of sensitive information.

An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. Attackers can exploit this to execute arbitrary code, cause denial of service, escalate privileges, obtain sensitive information, and possibly cause other unspecified impacts.

An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. Attackers can execute arbitrary code, cause denial of service, escalate privileges, obtain sensitive information, and possibly cause other unspecified impacts.

An OS Command Injection vulnerability exists in EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware 6010-0071-000 Ver 4.00. Attackers can execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.

An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows attackers to gain sensitive information and potentially cause other unspecified impacts.

A Cross Site Scripting (XSS) vulnerability has been found in EndRun Technologies Sonoma D12 Network Time Server (GPS) running F/W 6010-0071-000 Ver 4.00. Attackers can exploit it to steal sensitive information and possibly cause other unspecified impacts.

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.

An OS Command Injection vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows attackers to execute arbitrary system commands and gain access to sensitive information.

A Cross Site Scripting (XSS) vulnerability has been discovered in the EndRun Technologies Sonoma D12 Network Time Server (GPS) running firmware F/W 6010-0071-000 Ver 4.00. This flaw allows an attacker to inject malicious scripts, potentially leading to the theft of sensitive information.

An OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, escalate privileges, and obtain sensitive information.

A CSRF vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) with firmware F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause denial of service, escalate privileges, and obtain sensitive information.

Kontrakt inteligentny BATBToken zawiera nieprawidłową implementację kontroli dostępu w funkcjach zarządzania białą listą. Funkcje setColdWhiteList() i setSpecialAddress() są zadeklarowane jako publiczne, co pozwala każdemu użytkownikowi na obejście ograniczeń transferowych i manipulację ustawieniami specjalnych adresów.