CVE Vulnerability Catalog

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

A vulnerability in ASUS SetupAsusServices v1.0.5.1 within Asus Armoury Crate v5.3.4.0 is caused by an unquoted service path, allowing local users to launch processes with elevated privileges.

The Space plugin in JetBrains IntelliJ IDEA before version 2023.2 was requesting excessive permissions.

emlog version 2.1.9 is vulnerable to arbitrary file deletion via admin emplate.php.

PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.

There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.

Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.

A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.

There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader, allowing it to load a JAR from a specified URL. This unbounded deserialization can lead to remote code execution.

Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products.

Fujitsu Real-time Video Transmission Gear 'IP series' uses hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, resulting in termination of video transmission.

A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This allows unauthenticated attackers to decrypt and view the meeting id and password.

In Directus, from version 10.3.0 to 10.5.0, permission filters are not properly checked when using GraphQL subscriptions. This leads to unauthorized users receiving events they should not have access to.

A vulnerability was found in phpscriptpoint Lawyer 1.6, classified as problematic. It affects an unknown part of the file search.php and leads to cross site scripting.

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to version 3.0.7.1, TDengine DataBase crashes on UDF nested query.

The copyparty file server software prior to version 1.8.7 contains a reflected XSS vulnerability via URL parameters `?k304=...` and `?setck=...`. This can lead to moving or deleting existing files on the server, as well as uploading new files using the account of the person who clicks the malicious link.

Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, allowing subsequent functions to be called with root privileges.