CVE Vulnerability Catalog

Wireshark versions 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 contain a vulnerability in the BT SDP dissector that can lead to an infinite loop. An attacker can exploit this flaw through packet injection or by crafting a malicious capture file.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which has the potential to facilitate the collection of information on ioLogik 4000 Series devices. This vulnerability may enable attackers to gather information for the purpose of assessing vulnerabilities and potential attack vectors.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, potentially exposing users to security risks. This vulnerability may allow attackers to trick users into interacting with malicious content, leading to unintended actions or unauthorized data disclosures.

A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set properly. The vulnerability may lead to security risks, potentially exposing user session data to unauthorized access and manipulation.

The vulnerability in CP-Plus DVR is due to improper input validation within the web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.

A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. The presence of an unauthorized service may enable unauthorized access to the device.

XWiki Platform has a vulnerability that allows remote code execution by an attacker with edit rights on the wiki. It exploits a flaw in the job scheduler and an issue with content author authorization. This vulnerability has been patched in XWiki versions 14.10.9 and 15.4RC1.

XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.

A stack-based buffer overflow exists in Juplink RX4-1500, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root.

In versions 4.7.0 and prior of the ETIC Telecom RAS web management portal, authentication is disabled by default. This could allow an attacker with adjacent network access to alter the device's configuration or cause a denial-of-service condition.

Walchem Intuition 9 firmware versions prior to v4.21 are missing authentication for some API routes of the management web server. This could allow an attacker to download and export sensitive data.

Cross Site Scripting (XSS) vulnerability in Sourcecodester Student Study Center Desk Management System version 1.0 allows attackers to run arbitrary code via crafted GET request to web application URL.

The vulnerability in the Shescape library for JavaScript may impact Windows users in a threaded context. It can lead to incorrect escaping for the wrong shell, allowing attackers to bypass protections.

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter.

XWiki Platform allows registered users to execute arbitrary scripts in the content field of their profile page, leading to rights escalation. This issue has been present since version 4.3M2 when support for the content field was added in the AppWithinMinutes application.

Craft is a content management system (CMS) for creating custom digital experiences. Bypassing the validatePath function can lead to remote code execution, posing a risk of malicious control over vulnerable systems.

XWiki Platform has a stored XSS vulnerability that can be exploited by registered users by setting a malicious payload in the time zone user preference. Although the time zone is selected from a dropdown, it can still be set using JavaScript or the appropriate URL.

Argo CD, a GitOps continuous delivery tool for Kubernetes, has a bug in versions starting from 2.6.0 that causes open web terminal sessions to not expire. This allows users to send websocket messages even after the token has expired.

OpenMNS Horizon versions 31.0.8 and earlier than 32.0.2 are vulnerable to XXE injection attacks in the file editor accessible to users with ROLE_FILESYSTEM_EDITOR privileges.