CVE Vulnerability Catalog

TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 are vulnerable to improper privilege management. After establishing an adb connection, entering the su command provides root access without requiring a password.

TeleAdapt RoomCast TA-2400 devices from versions 1.0 to 3.1 suffer from the use of hard-coded passwords (PINs), including values: 385521, 843646, and 592671.

TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 is vulnerable to improper access control, specifically allowing access to Android Debug Bridge (adb).

There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.5.0.

There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.4.0.

The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the 'events_receiver' function in versions up to and including 0.0.9.18. This allows unauthenticated attackers to add, modify, or delete posts and taxonomies, install, activate, or deactivate plugins, change customizer settings, and manage users, including administrator users.

A stack-based overflow vulnerability exists in Fortinet FortiOS (versions 7.0.0 to 7.0.10 and 7.2.0 to 7.2.3) and FortiProxy (versions 7.0.0 to 7.0.9 and 7.2.0 to 7.2.2) that allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.

PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader, allowing it to load a JAR from a specified URL. This unbounded deserialization can lead to remote code execution.

Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php.

An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution. By sending specially crafted packets to the PAPI UDP port (Aruba's access point management protocol), it is possible to gain access to the operating system as a privileged user.

Multiple underlying services contain buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets to the PAPI UDP port (Aruba's access point management protocol). Successful exploitation of these vulnerabilities allows arbitrary code execution as a privileged user on the underlying operating system.

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution. By sending specially crafted packets to the PAPI UDP port (Aruba's access point management protocol), it is possible to gain access to the operating system with privileged user rights.

Java object deserialization issue in Jackrabbit webapp/standalone allows remote code execution by an attacker. This affects RMIVersions up to 2.20.10 (stable branch) and 2.21.17 (unstable branch) using the 'commons-beanutils' component.

CVE-2023-35088 describes an improper neutralization of special elements used in an SQL command vulnerability in Apache InLong, which may lead to SQL injection attacks. The issue affects versions from 1.4.0 through 1.7.0.

The Infodrom Software E-Invoice Approval System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 20230701.

CVE-2023-3046 is a vulnerability related to improper neutralization of special elements used in SQL commands, allowing SQL Injection attacks in Biltay Technology's Scienta system. This issue affects versions before 20230630.1953.

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.