CVE Vulnerability Catalog

A critical vulnerability was found in DedeCMS version 5.7.110, affecting unknown code in the file /uploads/tags.php. Manipulation of the argument tag_alias leads to SQL injection.

A critical vulnerability has been identified in the TOTOLINK N200RE V5 9.3.5u.6437_B20230519 device, concerning the Validity_check function. The issue is related to format string manipulation, allowing for remote attack initiation.

A critical vulnerability was found in the Byzoro Smart S45F Multi-Service Secure Gateway management platform up to version 20230822. The issue affects an unknown functionality of the file /importexport.php, leading to SQL injection.

A critical vulnerability was found in Tenda AC8 version 16.03.34.06_cn_TDC01 in the formSetDeviceName function, leading to stack-based buffer overflow. The vulnerability can be exploited remotely.

A vulnerability was found in Dreamer CMS up to version 4.1.3 that allows remote access to files or directories through manipulation of the file /upload/ueditorConfig?action=config. It is classified as problematic with a high complexity of attack.

A critical vulnerability was found in IBOS OA version 4.5.5, affecting unknown processing of the file ?r=dashboard/user/export&uid=X. Manipulation of this file leads to SQL injection.

A critical vulnerability has been found in IBOS OA version 4.5.5, affecting unknown code in the file ?r=diary/default/del of the Delete Logs Handler component. Manipulation of this vulnerability leads to SQL injection.

A critical vulnerability was found in IBOS OA 4.5.5, affecting an unknown part of the file ?r=email/api/delDraft&archiveId=0 of the Delete Draft Handler component. The manipulation leads to SQL injection.

A critical vulnerability has been found in the Byzoro Smart S85F Management Platform up to version 20230820. The issue affects an unknown functionality of the file /sysmanage/updateos.php, allowing unrestricted file uploads through manipulation of the argument 1_file_upload.

There is a heap-based buffer overflow vulnerability in the GitHub repository vim/vim prior to version 9.0.1331.

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotiation. The Disable Peer Verification property was effectively flipped, disabling verification by default when using HTTPS.

Proscend Advice ICR Series routers FW version 1.76 have a vulnerability related to the use of default credentials, which may lead to unauthorized access.

ForeScout NAC SecureConnector version 11.2 has a vulnerability related to uncontrolled search path element, which may lead to unauthorized access to the system.

A 2017 Hyundai model has a vulnerability allowing authentication bypass via capture-replay attacks.

StarTrinity Softswitch version 2023-02-16 contains multiple CSRF vulnerabilities (CWE-352) that may allow attackers to perform unauthorized actions on behalf of users.

In version 2023-02-16 of StarTrinity Softswitch, there is an Open Redirect vulnerability that may lead to unauthorized redirection of users to malicious sites.

In version 2023-02-16 of StarTrinity Softswitch, there is a persistent XSS vulnerability (CWE-79) that may allow attackers to inject malicious JavaScript code into the application.

Version 2023-02-16 of StarTrinity Softswitch has multiple reflected XSS vulnerabilities (CWE-79). An attacker can exploit these vulnerabilities to inject malicious JavaScript code into server responses.

ProVide version 14.5 by Farsight Tech Nordic AB contains multiple XSS vulnerabilities (CWE-79) that can be exploited by a user with administrator privileges.

The vulnerability in 7Twenty BOT involves improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) attacks. An attacker can inject malicious JavaScript code that will be executed in users' browsers.