CVE Vulnerability Catalog

Wtyczka WordPress Password Reset with Code dla API REST WordPressa w wersjach przed 0.0.17 nie wykorzystuje algorytmów kryptograficznych do generowania kodów OTP, co może prowadzić do przejęcia konta.

Podman container cbis_manager jest podatny na zdalne wykonanie poleceń poprzez punkt końcowy /api/plugins. Niewłaściwe oczyszczanie nagłówków HTTP X-FILENAME, X-PAGE i X-FIELD umożliwia wstrzyknięcie poleceń, co pozwala atakującemu na wykonanie dowolnych poleceń na systemie.

API CBIS/NCS Manager jest podatne na obejście uwierzytelnienia. Wysyłając specjalnie skonstruowany nagłówek HTTP, nieautoryzowany użytkownik może uzyskać dostęp do funkcji API bez podawania ważnych poświadczeń.

A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=update_profile. The manipulation of the argument phone results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. Other parameters might be affected as well.

W systemie zarządzania użytkownikami PHPGurukul w wersji 1.0 odkryto lukę bezpieczeństwa, która dotyczy nieznanej funkcji w pliku /login.php. Manipulacja argumentem emailid prowadzi do wstrzyknięcia SQL.

Zidentyfikowano podatność w systemie rezerwacji hotelowej SourceCodester w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku deleteuser.php, co prowadzi do możliwości wstrzyknięcia SQL poprzez manipulację argumentem ID.

W systemie rezerwacji hotelowej SourceCodester w wersji 1.0 zidentyfikowano podatność. Problem dotyczy nieznanej funkcji w pliku editroomimage.php, która umożliwia wstrzyknięcie SQL poprzez manipulację argumentem ID.

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a memory corruption condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing LI files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing AR files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to an out-of-bounds write past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read before the start of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing AR files. It results from lack of validation of user-supplied data, leading to an out-of-bounds write. Requires user interaction (opening a malicious file or visiting a malicious page).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (opening a malicious file or visiting a malicious page).