CVE Vulnerability Catalog

A SQL Injection vulnerability was found in the extension script in PostgreSQL when using @extowner@, @extschema@, or @extschema:...@ inside a quoting construct. An attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

CVE-2023-3937 describes a cross site scripting vulnerability in the web portal of Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows. It allows an authenticated user with high privileges to trigger an XSS attack via the web browser.

A blind SQL injection vulnerability exists in Snow Software license manager versions from 8.0.0 to 9.30.1 on Windows. A logged-in user with high privileges can inject SQL commands via the web portal.

CVE-2023-39553 describes an improper input validation vulnerability in Apache Airflow Drill Provider that allows an attacker to pass malicious parameters when establishing a connection with DrillHook, enabling file reading on the Airflow server.

Mattermost fails to sanitize post metadata during audit logging, resulting in permalinks contents being logged.

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.

Mattermost fails to check if the requesting user is a guest, allowing guests to view, join, edit, export, and archive public playbooks.

Mattermost fails to delete the attachments when deleting a message in a thread, allowing a simple user to still access and download the attachment of a deleted message.

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. This issue exists because of an incomplete fix for CVE-2022-24439.

Versions of Genians Genian NAC and Genian ZTNA have a vulnerability that allows code download without integrity check, enabling malicious software updates.

EmpowerID versions before 7.205.0.1 allow an attacker to bypass MFA requirements if the first factor (username and password) is known. Knowing the first factor enables changing the account's email address, to which MFA codes are then sent.

Improper authentication vulnerability in Genians Genian NAC and Genians Genian ZTNA allows authentication abuse. This affects versions from V4.0.0 to V4.0.155 and from V5.0.0 to V5.0.54.

In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar files, insufficient length checking may lead to a stack buffer overflow, potentially resulting in memory corruption or RCE.

In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, various XML functions rely on libxml global state to track configuration variables. This state can be altered by other modules, leading to the potential loading of external XML entities and disclosure of local files accessible to PHP.

A vulnerability was discovered in Veritas NetBackup Snapshot Manager before version 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service.

A race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

A protection mechanism failure in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for Linux may allow an authenticated user to potentially enable escalation of privilege via local access.

Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

Improper input validation in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.