CVE Vulnerability Catalog

A use-after-free flaw was found in the memory management subsystem in the Linux Kernel, located in mm/mempolicy.c. This issue is caused by a race between mbind() and VMA-locked page fault, which may allow a local attacker to crash the system or lead to a kernel information leak.

CVE-2023-4296 allows an attacker to inject arbitrary code into the browser on the target device if they can trick an admin user of PTC Codebeamer into clicking on a malicious link.

A Stored Cross-Site Scripting (XSS) vulnerability in Usermin 2.001's SSH configuration tab allows remote attackers to inject arbitrary web scripts or HTML via options for the host value while editing host options.

Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker to cause a denial of service via the chucnked_vectors.rs component.

Badaso versions 0.0.1 through 2.9.7 have a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.

Use after free in MediaStream in Google Chrome prior to version 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application.

A cross-site scripting (XSS) vulnerability in the device web interface of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern.

CVE-2023-39268 in ArubaOS-Switch is a memory corruption vulnerability that could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation allows arbitrary code execution as a privileged user on the underlying operating system.

An authenticated remote code execution vulnerability exists in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.

A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

A vulnerability in TripSpark VEO Transportation and NovusEDU allows SQL injection through unsanitized POST parameters. Attackers can manipulate student busing information search queries.

An arbitrary file write vulnerability allows an authenticated, remote attacker with administrator privileges to alter logging variables to overwrite arbitrary files on the remote host with log data.

A pass-back vulnerability exists in the Nessus application before version 10.6.0, allowing an authenticated remote attacker with administrator privileges to uncover stored SMTP credentials.

In goauthentik, an open-source Identity Provider, affected versions with an enabled recovery flow allow an attacker to determine if a username exists. This issue only affects setups configured with a recovery flow.

Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In versions up to 5.9.0, during the verification of Cleartext Signed Messages, any data preceding the 'Hash: ...' header was ignored, allowing attackers to add arbitrary text that could be perceived as signed.

A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution.