CVE Vulnerability Catalog

A vulnerability in the sofa-hessian component of Solon before v2.3.3 allows attackers to execute arbitrary code by providing crafted payload.

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

In OpenBSD 7.2 before errata 026 and 7.3 before errata 004, as well as in LibreSSL before 3.6.3 and 3.7.x before 3.7.3, a double free or use after free could occur after SSL_clear.

A buffer overflow vulnerability was discovered in the TP-Link Archer AX10 (EU) router firmware version V1.2_230220, specifically in the function FUN_131e8 - 0x132B4. This could allow an attacker to execute arbitrary code or cause a denial of service.

Versions 3.5.0 and 3.5.1 of jeecg-boot have a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface.

Simple Customer Relationship Management version 1.0 is vulnerable to SQL Injection via the email parameter.

Vulnerability in HwWatchHealth that can be exploited to hijack the application. Successful exploitation may lead to repeated pop-up windows of the app.

A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2021.0.8 that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.

PublicCMS versions up to 4.0.202302 are vulnerable to insecure permissions, potentially allowing unauthorized access to resources.

In cmseasy v7.7.7.7 20230520, a path traversal vulnerability was discovered in the add_action method in lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform local file inclusion.

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection, allowing remote code execution by a user with page editing privileges.

The cpdb-libs libraries, used in the Common Printing Dialog Backends project, are vulnerable to buffer overflows in versions 1.0 through 2.0b4 due to improper use of `scanf(3)`. The issue arises because the length of read strings is not limited, leading to buffer overflows when a string exceeds 1023 characters.

Langchain versions before v0.0.225 contain a remote code execution (RCE) vulnerability in the JiraAPIWrapper component. This vulnerability allows attackers to execute arbitrary code via crafted input.

CVE-2023-34865 in ujcms 6.0.2 has a directory traversal vulnerability that allows attackers to move files via the rename feature.

Version 0.5.2.1 of the bloofox application was found to contain a SQL injection vulnerability via the cid parameter in admin/index.php?mode=settings&page=charset&action=edit.

Version 0.5.2.1 of the bloofox application was found to contain a SQL injection vulnerability via the userid parameter in admin/index.php?mode=user&action=edit.

Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the pid parameter in admin/index.php?mode=settings&page=plugins&action=edit.

Version 0.5.2.1 of bloofox was found to contain a SQL injection vulnerability via the tid parameter in admin/index.php?mode=settings&page=tmpl&action=edit.

A SQL injection vulnerability was discovered in bloofox v0.5.2.1 via the lid parameter in admin/index.php. An attacker can exploit this flaw to manipulate database queries.