CVE Vulnerability Catalog

Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server.

SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03 allows an attacker with local access to the system to place a malicious library that can be executed by the application. An attacker could thereby control the behavior of the application.

The B1i module of SAP Business One version 10.0 allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify SQL data. Successful exploitation can significantly impact the confidentiality, integrity, and availability of the application.

PrestaShop is an open source e-commerce application. Prior to version 8.1.1, it was possible to delete files from the server via the CustomerMessage API.

PrestaShop prior to version 8.1.1 allows for file deletion from the server using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue.

PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.

PrestaShop, as an open-source e-commerce application, is vulnerable to cross-site scripting (XSS) attacks through the `isCleanHTML` method in versions prior to 1.7.8.10, 8.0.5, and 8.1.1. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch.

PrestaShop is an open source e-commerce application that is vulnerable to remote code execution through SQL injection and arbitrary file write in the back office in versions prior to 1.7.8.10, 8.0.5, and 8.1.1.

PrestaShop prior to version 8.1.1 has a vulnerability in the back office that allows file compromise through a path traversal attack. This can be achieved by replaying the import file deletion query with a specified file path that exploits this vulnerability.

ScanCode.io prior to version 32.5.1 has a command injection vulnerability in the docker fetch process. It allows appending malicious commands in the `docker_reference` parameter, leading to unauthorized command execution.

A critical vulnerability was found in SourceCodester Inventory Management System version 1.0. The issue affects some unknown processing of the file ex_catagory_data.php, leading to SQL injection.

PrestaShop prior to version 8.1.1 had an SQL injection vulnerability in the product search field on the product page in the admin panel. Version 8.1.1 includes a patch for this issue.

Cryptomator version 1.9.2 allows local privilege escalation for low privileged users via the `repair` function in the MSI installer. The issue arises from the MSI's repair function spawning a SYSTEM Powershell without the `-NoProfile` parameter, leading to the loading of the user's profile.

The import-in-the-middle module, used for loading ESM modules, prior to version 1.4.2 allowed for remote code execution when an application passed user-supplied input directly to the `import()` function. Version 1.4.2 introduces fixes that mitigate this vulnerability.

A critical vulnerability has been found in SourceCodester Inventory Management System version 1.0. Manipulation of the argument columns[1][data] leads to SQL injection, which can be exploited remotely.

Multiple buffer overflows were discovered in Netgear JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7 via the http_passwd and http_username parameters in the check_auth function.

Versions 0.2.15, 0.2.16, and 0.3.0 of the Vyper language have a flaw in the allocation of named re-entrancy locks, allowing cross-function re-entrancy in contracts. Version 0.3.1 contains a fix for this issue.

Sentry is an error tracking and performance monitoring platform. In versions from 22.1.0 to prior to 23.7.2, an attacker with access to a token with limited scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes.

Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6, and FH1205 V2.0.0.7 were found to contain a stack overflow vulnerability via the ssid parameter in the form_fast_setting_wifi_set function.

Tenda F1202 V1.2.0.9 and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the mit_ssid parameter in the formWrlsafeset function.