CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.23)
Insufficient session expiration exists in GitHub repository fossbilling/fossbilling prior to version 0.5.5.
CVE-2023-37214 affects the Heights Telecom ERO1xS-Pro device with firmware version FW BZ_ERO1XP.025. This issue may lead to unauthorized access or other security-related threats.
Version 2.2.0 and below of university compass was found to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability can be exploited by passing an unchecked argument.
Versions oscore v2.2.6 and below were found to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability can be exploited by passing an unchecked argument.
Versions wix-embedded-mysql v4.6.1 and below were found to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability can be exploited by passing an unchecked argument.
Versions of stanford-parser v3.9.2 and below were found to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability can be exploited by passing an unchecked argument.
FFmpeg version 0.7.0 and below contains a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited by passing an unchecked argument.
Versions quartz-jobs 2.3.2 and below contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited by passing an unchecked argument.
Versions bboss-persistent v6.0.9 and below were found to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited by passing an unchecked argument.
Versions of webmagic-extension v0.9.0 and below were discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.
Duke v1.2 and below was found to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability can be exploited by loading a crafted camera calibration file.
Version 3.5.1 of jeecg-boot was found to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in several versions of Apple operating systems.
A use-after-free issue was addressed with improved memory management. This issue is fixed in several versions of Apple operating systems.
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8, iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, and macOS Ventura 13.5.
An integer overflow was addressed with improved input validation. This issue is fixed in several versions of Apple operating systems.
The issue concerns improper memory handling, which may allow an app to execute arbitrary code with kernel privileges. It has been fixed in several versions of Apple operating systems.
TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 are vulnerable to improper privilege management. After establishing an adb connection, entering the su command provides root access without requiring a password.