CVE Vulnerability Catalog

The Unica application exposes an API that accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity (XXE) attacks against the backend service.

A local user could edit the VideoEdge configuration file, potentially disrupting its operation.

emlog version 2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.

Versions before 0.1.3 of the ai-dev aioptimizedcombinations library were found to contain a SQL injection vulnerability via the component /includes/ajax.php.

Dango-Translator v4.5.5 was found to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json.

The infotainment system in Renault Zoe EV 2021 vehicles in versions from 283C35202R to 283C35519R is vulnerable to attacks that can crash the system by sending arbitrary USB data via a USB device.

CVE-2023-36217 is a Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 that allows a remote attacker to execute arbitrary code via the category name field of the image manager function.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository pimcore/customer-data-framework prior to version 3.4.2, allowing for the storage of malicious code.

MotoCMS version 3.4.3 contains an SQL injection vulnerability that allows a remote attacker to gain privileges via the keyword parameter of the search function.

An arbitrary file download vulnerability in jizhi CMS version 1.9.5 in the /c/PluginsController.php component allows attackers to execute arbitrary code via downloading a crafted plugin.

CVE-2023-38947 describes an arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1, allowing attackers to execute arbitrary code via a crafted PHP file.

A SQL injection vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing authenticated users to inject arbitrary SQL directives into SQL statements and execute arbitrary SQL commands.

A path traversal vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing unauthenticated attackers to fetch arbitrary files from the server.

An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server.

An authentication bypass vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing unauthenticated users to access some functionality on BioStar 2 servers.

In the GitHub repository ikus060/rdiffweb prior to version 2.8.0, there is an issue with resource allocation without limits or throttling.

CVE-2023-4136 describes an improper neutralization of input during web page generation in the CrafterCMS engine, leading to Cross-site Scripting (XSS) vulnerabilities. This affects CrafterCMS versions from 4.0.0 to 4.0.2 and from 3.1.0 to 3.1.27.

A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching, potentially leading to a system crash.

A use-after-free vulnerability was found in the smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in, allowing a local user to crash the system, causing a denial of service condition.