CVE Vulnerability Catalog

Versions 3.3.2 and 3.3.3 of funadmin are vulnerable to insecure file upload via plugin installation.

A remote code execution (RCE) vulnerability was discovered in Onlyoffice Community Server before version 12.5.2 via the UploadProgress.ashx component.

Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.

A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.

The Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, allowing an attacker to manipulate SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process.

Apache Accumulo 2.1.0 has an improper authentication vulnerability that may allow successful authentication with invalid credentials. Users are advised to upgrade to 2.1.1.

Netgear R6250 firmware version 1.0.4.48 is vulnerable to buffer overflow after authentication.

CloudPanel 2 before version 2.3.1 has insecure cookie authentication in the file manager.

XWiki Platform is a generic wiki platform that allows executing any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This issue has been patched in XWiki versions 15.1-rc-1 and 14.10.5.

Adiscon LogAnalyzer v4.1.13 and earlier is vulnerable to SQL Injection.

Langchain version 0.0.171 is vulnerable to arbitrary code execution in the load_prompt function.

Zoho ManageEngine ADSelfService Plus through version 6113 has an authentication bypass vulnerability that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving domain controller administrator privileges.

There is a vulnerability in the Notepad app related to improper permission control. Successful exploitation of this vulnerability may lead to privilege escalation, affecting availability and confidentiality.

CVE-2023-2907 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in the Marksoft application.

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Memory safety bugs exist in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.

In Siren Investigate versions before 13.2.2, session keys remain active even after logging out.

A buffer overflow in Nintendo Mario Kart Wii versions RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet.

A buffer overflow in Counter-Strike allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.

In Suricata before version 6.0.13, an adversary controlling an external source of Lua rules may be able to execute Lua code. This issue is addressed in version 6.0.13 by disabling Lua unless the allow-rules option is set to true in the Lua security configuration section.