CVE Vulnerability Catalog

M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 have a path traversal issue that allows authenticated users to read some restricted files on the web server.

AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.

The 'Skylark' App for Android version 6.2.13 and earlier and for iOS version 6.2.13 and earlier has improper authorization in the handler for custom URL scheme. This allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device.

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) and Arbitrary Usermeta Update. These issues arise from insufficient input sanitization and output escaping in the 'save' function.

A Regular expression Denial-of-Service (ReDoS) vulnerability exists in multiple add-ons for Mailform Pro CGI version 4.3.1.3 and earlier. An unauthenticated remote attacker can cause a denial-of-service condition.

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with permission to perform POST requests on the /api/v1/alerts endpoint could execute arbitrary JavaScript code on users of Prometheus Alertmanager.

Datasette is an open source tool for exploring and publishing data, which has a vulnerability in versions 1.0 alpha - 1.0a3. The issue involves the disclosure of database and table names at the API explorer endpoint, which may occur if the user is not authenticated.

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5, affecting servers using TLS client authentication. If a TLS server-side socket is closed quickly, data may still be readable from the socket buffer without authentication.

In the password recovery form of Silverware Games, the response time varies depending on whether the specified email address exists in the database. This issue has been fixed in version 1.3.7.

In version 1.3.6 of Silverware Games, the password recovery form's behavior was changed. The form now always displays a message about sending a code, regardless of whether the provided email is associated with a user account.

In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Edit Category function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.

In version 2.9.7 of Badaso, there is a stored XSS vulnerability in the Add Tag function that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.

A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.

Cargo versions from 1.60.0 to 1.72 did not escape Cargo feature names in reports generated by `cargo build --timings`, potentially allowing for malicious HTML injection. A malicious package included as a dependency could inject JavaScript, creating cross-site scripting risks.

Rizin is a reverse engineering framework that is vulnerable to integer overflow in the `consume_count` function in versions 0.6.0 and prior. The issue arises from a missing overflow check, leading to calculation errors.

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery, allowing an attacker to port scan internal hosts and request information from them.

In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in 'card fields' is not properly escaped. Agile dashboard administrators can be forced to execute uncontrolled code by deleting a kanban with a malicious label.

Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in the user information acquisition.