CVE Vulnerability Catalog

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

Listed NETGEAR router models have insufficient input validation in the time server (NTP) setting. An attacker connected to the router's local network with administrator credentials can run unauthorized commands on the router. This impacts router integrity, with no impact on confidentiality or availability.

A vulnerability in the network messaging layer of Commvault involves improper handling of highly compressed data affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in QAPI (part of Commvault) involves a stack-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()

mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction

Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to trigger an out-of-bounds memory read.

SFTPGo prior to 2.7.5 allows an authenticated SSH user to send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified.

A vulnerability in MediaAgent (part of Commvault) involves a heap-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

CVFS contained an input validation issue affecting command execution. Software customers should upgrade to the resolved maintenance release.

A vulnerability in CVFS (part of Commvault) involves a missing authentication condition affecting command execution. Customers are advised to upgrade to the resolved maintenance release.

CvFWD contained a null pointer dereference affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CvFWD contained an out-of-bounds write affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CvFWD contained an integer overflow affecting service availability. The vendor recommends upgrading to the resolved maintenance release.