CVE Vulnerability Catalog

PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.

An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.

CVE-2023-37245 describes a buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.

Vulnerability in the atcmdserver module allows interception of commands from the modem. Attackers may exploit this vulnerability to rewrite NVRAM or facilitate the exploitation of other vulnerabilities.

Vulnerability related to missing input length verification in the distributed file system. Successful exploitation of this vulnerability may lead to out-of-bounds read.

A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4). An attacker could exploit this vulnerability to gain unauthorized access to the MOVEit Transfer database.

Versions of protobuf.js (protobufjs) from 6.10.0 to 7.x before 7.2.5 are vulnerable to Prototype Pollution. An attacker can exploit a user-controlled protobuf message to modify the Object.prototype, allowing for the addition and overwriting of data and functions.

Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.

The Ultimate Member WordPress plugin before version 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.

An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.

CVE-2023-35797 describes an improper input validation vulnerability in Apache Airflow Hive Provider before version 6.1.1. This allows bypassing security checks and remote code execution (RCE) via the principal parameter.

OpenTSDB, an open-source, distributed time series database, is vulnerable to remote code execution by writing user-controlled input to a Gnuplot configuration file and running Gnuplot with the generated configuration.

There is an SQL Injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.3.

XWiki Platform allows users with edit rights to modify all pages in the `CKEditor` space, which can lead to the removal of technical documents and editing the JavaScript configuration of CKEditor, resulting in persistent XSS.

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3, where an attempt to block a user fails after a temporary browser hang, resulting in a DBQueryDisconnectedError error message.

Certain HP LaserJet Pro print products are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function.