CVE Vulnerability Catalog

KramerAV VIA GO² versions below 4.0.1.1326 are vulnerable to unauthenticated file upload, leading to Remote Code Execution (RCE).

TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setDiagnosisCfg. This vulnerability allows an attacker to execute arbitrary commands through the 'ip' parameter.

TOTOLINK X5000R versions V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command injection vulnerability in the setOpModeCfg function. This vulnerability allows an attacker to execute arbitrary commands through the 'hostName' parameter.

Wtyczka Wordapp dla WordPressa jest podatna na obejście autoryzacji z powodu niewystarczająco unikalnego podpisu kryptograficznego w funkcji 'wa_pdx_op_config_set' w wersjach do 1.6.0 włącznie. Umożliwia to nieautoryzowanym atakującym zmianę 'validation_token' w konfiguracji wtyczki.

A vulnerability was found in ImageMagick that leads to a remote code execution vulnerability in OpenBlob when the --enable-pipes option is configured.

BlueCMS version 1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php.

RIOT-OS, an operating system for IoT devices, contains a network stack capable of processing 6LoWPAN frames. In version 2023.01 and prior, an attacker can send a crafted frame to the device resulting in an out of bounds write in the packet buffer.

A vulnerability in Emby Server may allow administrative access to the system, depending on user account settings. An attacker could spoof headers, enabling passwordless login or viewing a list of user accounts that may not have a password configured.

Pomerium, as an identity and context-aware access proxy, may make incorrect authorization decisions due to specially crafted requests. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, and 0.22.2.

ToUI is a Python package for creating user interfaces that uses Flask-Caching to store user variables. Versions 2.0.1 to 2.4.0 are affected by an issue with the `Website.user_vars` property. This issue has been patched in version 2.4.1.

In Moov signedxml through 1.0.0, parsing the raw XML can result in different output than parsing the canonicalized XML. This allows for bypassing signature validation via a Signature Wrapping attack (XSW).

The scquickaccounting module in Store Commander for PrestaShop up to version 3.7.3 allows multiple sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.

The scfixmyprestashop module in Store Commander through 2023-05-09 for PrestaShop allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to blind SQL injection.

The scexportcustomers module in Store Commander for PrestaShop up to version 3.6.1 allows sensitive SQL calls to be executed with a trivial HTTP request, potentially leading to a blind SQL injection vulnerability.

CVE-2023-2851 describes an improper neutralization of special elements used in SQL commands, allowing command line execution through SQL Injection. This issue affects all versions of AGT Tech Ceppatron software.

CVE-2023-2887 vulnerability affects the CBOT Chatbot, allowing authentication bypass through spoofing. This issue exists in versions Chatbot before Core: v4.0.3.4 and Panel: v4.0.3.7.

The vulnerability in CBOT Chatbot is related to the use of a cryptographically weak pseudo-random number generator, allowing signature spoofing through key recreation.

The vulnerability in CBOT Chatbot related to the generation of incorrect security tokens allows for token impersonation and privilege abuse.

Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.1 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas synchronizacji koszyka z mobilnego żądania REST API przez wtyczkę.

Wtyczka MStore API dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 3.9.0 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika dostarczanego podczas żądania REST API dotyczącego realizacji kuponu przez wtyczkę.