CVE Vulnerability Catalog

YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher component. An attacker can exploit this flaw to read sensitive files from the server.

An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script sent to the FrameworkShellController component.

The vulnerability in Consensys Discovery versions prior to 0.4.5 uses the same AES/GCM nonce for the entire session, while it should be unique for every message. The node's private key is not compromised, only the session key generated for specific peer communication is exposed.

Hard-coded credentials in FOLIO mod-data-export-spring before version 1.5.4 and from 2.0.0 to 2.0.2 allow unauthenticated users to access critical APIs, modify user data, change configurations including single-sign-on, and manipulate fees/fines.

DependencyCheck for Maven 9.0.0-9.0.6, CLI 9.0.0-9.0.5, and Ant 9.0.0-9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

A vulnerability in ClickHouse libraries (clickhouse-r2dbc, clickhouse-jdbc, clickhouse-client) prior to version 0.4.6 exposes sensitive information in exceptions. When 'sslkey' is specified and an exception (e.g., ClickHouseException or SQLException) occurs, the client certificate password is included in the error message, allowing unauthorized users to capture it.

Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allow unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.

A vulnerability in the Java implementation of CBOR (library com.upokecenter.cbor) versions 4.0.0 to 4.5.1 is due to inefficient algorithmic complexity in the DecodeFromBytes function. An attacker can cause a denial of service (DoS) by providing specially crafted input.

A vulnerability in Artemis Java Test Sandbox versions prior to 1.7.6 allows a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can exploit this issue to execute arbitrary Java code when a victim runs the supposedly sandboxed code.

A vulnerability in Artemis Java Test Sandbox before version 1.8.0 allows a sandbox escape by including trusted class files. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.

A vulnerability in Artemis Java Test Sandbox before version 1.11.2 allows a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can exploit this to execute arbitrary Java code when a victim runs the supposedly sandboxed code.

AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and versions earlier than 1.9.0 incorrectly validate some invalid ECDSA signatures. This could lead to acceptance of forged signatures.

CVE-2024-23679 in Enonic XP versions before 7.7.4 allows a remote unauthenticated attacker to reuse prior sessions due to missing session attribute invalidation.

Cross-site scripting vulnerability in MolecularFaces before 0.3.0 allows a remote attacker to execute arbitrary JavaScript in the victim's browser via crafted molfiles.

Vulnerability in PCMan FTP Server 2.0.7, related to the STOR command handler. Manipulation leads to denial of service (DoS). The attack can be initiated remotely, and the exploit is publicly disclosed.

Vulnerability in PCMan FTP Server 2.0.7, related to the PUT command handler. Manipulation leads to denial of service (DoS). The attack can be initiated remotely, and the exploit is publicly disclosed.

Podatność typu Server-Side Request Forgery (SSRF) występuje w kilku wtyczkach i motywach WordPressa, w tym Montonio dla WooCommerce oraz Wpopal Core Features. Problem ten pozwala atakującym na wysyłanie złośliwych żądań z serwera, co może prowadzić do nieautoryzowanego dostępu do zasobów wewnętrznych.

In the actiNAS SL 2U-8 RDX version 3.2.03-SP1, improper access control was found in the nasSvr.php file. A remote attacker can read and modify different types of data without authentication.

Multiple reflected XSS vulnerabilities were found in nasSvr.php of actiNAS-SL-2U-8 version 3.2.03-SP1. They allow remote attackers to inject arbitrary web script or HTML.

An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted JSP file. An attacker can upload a malicious file that gets executed on the server.