CVE Vulnerability Catalog

PHP-IMAP prior to version 5.3.0 has a remote code execution vulnerability due to unsanitized attachment filenames. An attacker can exploit this vulnerability by sending a malicious attachment, leading to code execution on the server.

XWiki Platform has a vulnerability allowing for XSS attacks by injecting JavaScript through a forged URL. This can be exploited using the previewactions template, potentially executing unauthorized code on the page.

XWiki Platform allows users to forge URLs with payloads, enabling JavaScript injection on the page (XSS). The DeleteApplication page can be exploited to perform an XSS attack using a specially crafted URL.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript code through forged URLs. Exploiting the resubmit template enables the execution of malicious code, potentially leading to user data exposure.

XWiki Platform allows users to forge URLs with payloads that enable JavaScript injection on the page (XSS). The deletespace template can be exploited to perform an XSS attack, for example using the URL: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain).

The XWiki Platform has a vulnerability that allows the injection of JavaScript (XSS) through a forged URL. Users can exploit the restore template to perform an XSS attack, potentially leading to unauthorized access to data.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript through a forged URL. Exploiting the delete template enables XSS attacks, which may lead to unauthorized access to user data.

XWiki Platform has a stored cross-site scripting (XSS) vulnerability that can be exploited by users with edit rights. Versions from 5.4.4 up to but not including 14.4.8, 14.10.4, and 15.0 are affected.

XWiki Platform, from version 12.9-rc-1 to 14.4.8, 14.10.6, and 15.1, allows logged-in users to add dangerous content in the first name field, leading to rights escalation. The vulnerability has been fixed in versions 14.4.8, 14.10.6, and 15.1.

XWiki Platform, a popular wiki platform, has a vulnerability that allows users with view rights on documents to execute code with programming rights. Versions from 2.40m-2 up to but not including 14.4.8, 14.10.4, and 15.0 are susceptible to remote code execution via a specially crafted URL.

In XWiki Platform, from version 11.8-rc-1 to 14.4.8, 14.10.6, and 15.2, any logged-in user can edit the `Mail.MailConfig` configuration. This allows them to change the mail obfuscation settings and view and edit mail sending configurations, including the SMTP domain name and credentials.

XWiki Platform versions from 2.2.1 to 14.4.8, 14.10.5, and 15.1RC1 are vulnerable to a stored cross-site scripting (XSS) attack. Users can insert HTML code into documents, allowing unauthorized actions to be performed by other users who visit those documents.

Fortinet FortiNAC versions below 7.2.1, below 9.4.3, below 9.2.8, and all earlier versions of 8.x are vulnerable to deserialization of untrusted data. An attacker can execute unauthorized code or commands via specifically crafted requests on the inter-server communication port.

Grafana validates Azure AD accounts based on the email claim. The email field in Azure AD profiles is not unique and can be easily modified, leading to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

A buffer overflow vulnerability was discovered in TP-Link TL-WR940N V4 via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.

CVE-2023-3326 affects the pam_krb5 module, which authenticates users by running kinit with the password. If a keytab is not provisioned on the system, the module trusts responses from the KDC, potentially allowing unauthorized access.

Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.

A remote code execution (RCE) vulnerability was discovered in Onlyoffice Community Server before version 12.5.2 via the UploadProgress.ashx component.

Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.

A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.