CVE Vulnerability Catalog

An out-of-bounds write in Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

Business logic errors in the GitHub repository froxlor/froxlor prior to version 2.0.22 and 2.1.0 may lead to unauthorized access or improper application behavior.

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.

CVE-2023-37511 concerns improper App Transport Security (ATS) settings that can lead to insecure loading of web content. If configured incorrectly, applications may be vulnerable to security attacks.

A vulnerability has been identified within Serv-U 15.4 that allows bypassing multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.

An NTLM Hash Disclosure was discovered in ArchiMate before version 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource.

HAProxy versions from 2.0.32 to 2.6.14 and from 2.7.0 to 2.8.1 forward empty Content-Length headers, violating RFC 9110 section 8.6. In rare cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request.

Zoho ManageEngine Applications Manager through version 16530 allows reflected XSS while logged in.

MISP version 2.4.174 allows XSS in app/View/Events/index.ctp.

In the OpenZeppelin Contracts library, versions from 4.0.0 to 4.9.2 have an issue where the `_msgSender` method may return `address(0)` for calls originating from a trusted forwarder with calldata shorter than 20 bytes. This issue has been patched in version 4.9.3.

A SQL injection vulnerability was discovered in iCMS v7.0.16 within the bakupdata function. Attackers can exploit this flaw to execute unauthorized database queries.

A SQL injection vulnerability was discovered in iCMS version 7.0.16 via the 'where' parameter in admincp.php. An attacker can exploit this flaw to execute unauthorized database queries.

In Netbox version 3.4.7, there is a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Custom Link templates.

A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE).

All UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring enabled and default settings are vulnerable to an integer overflow, potentially allowing Remote Code Execution (RCE).

In version 1.4.3 of the 1Panel, there is an arbitrary file write vulnerability that could lead to direct control of the server. The issue arises from a lack of parameter filtering in the `SaveContent` function in the `api/v1/file.go` file.

In version 1.4.3 of the 1Panel, authenticated attackers can download arbitrary files through the API interface, leading to unauthorized access. This may result in significant information leakage.

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, there is a vulnerability that allows an attacker to read arbitrary important configuration files on the server due to unfiltered request parameters.