CVE Vulnerability Catalog

Duke v1.2 and below was found to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.

BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability can be exploited by loading a crafted camera calibration file.

Version 3.5.1 of jeecg-boot was found to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in several versions of Apple operating systems.

A use-after-free issue was addressed with improved memory management. This issue is fixed in several versions of Apple operating systems.

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8, iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, and macOS Ventura 13.5.

An integer overflow was addressed with improved input validation. This issue is fixed in several versions of Apple operating systems.

The issue concerns improper memory handling, which may allow an app to execute arbitrary code with kernel privileges. It has been fixed in several versions of Apple operating systems.

TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 are vulnerable to improper privilege management. After establishing an adb connection, entering the su command provides root access without requiring a password.

TeleAdapt RoomCast TA-2400 devices from versions 1.0 to 3.1 suffer from the use of hard-coded passwords (PINs), including values: 385521, 843646, and 592671.

TeleAdapt RoomCast TA-2400 versions 1.0 through 3.1 is vulnerable to improper access control, specifically allowing access to Android Debug Bridge (adb).

There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.5.0.

There is an OS Command Injection vulnerability in the GitHub repository jgraph/drawio prior to version 21.4.0.

The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the 'events_receiver' function in versions up to and including 0.0.9.18. This allows unauthenticated attackers to add, modify, or delete posts and taxonomies, install, activate, or deactivate plugins, change customizer settings, and manage users, including administrator users.

A stack-based overflow vulnerability exists in Fortinet FortiOS (versions 7.0.0 to 7.0.10 and 7.2.0 to 7.2.3) and FortiProxy (versions 7.0.0 to 7.0.9 and 7.2.0 to 7.2.2) that allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.

PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader, allowing it to load a JAR from a specified URL. This unbounded deserialization can lead to remote code execution.

Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php.

An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.