CVE Vulnerability Catalog

A flaw was found in the QEMU built-in VNC server that occurs during connection handling. When a client connects to the VNC server, QEMU checks the number of connections and may lead to a NULL pointer dereference, resulting in a denial of service.

CVE-2023-37597 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via the delete user grouplist function.

CVE-2023-37596 in issabel-pbx version 4.0.0-6 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.

In Redis 7.0 prior to 7.0.12, a vulnerability exists that may lead to a heap overflow when extracting key names from a command and a list of arguments. This can result in reading random heap memory, heap corruption, and potentially remote code execution.

Relative path traversal in the Zoom Client SDK before version 5.15.0 may allow an unauthorized user to enable information disclosure via local access.

Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access.

A critical vulnerability was found in IBOS OA 4.5.5 in the createDeleteCommand function of the file ?r=article/default/delete of the Delete Packet component. Manipulation of this function leads to SQL injection, allowing for remote attacks.

A critical vulnerability was found in SourceCodester AC Repair and Services System version 1.0. The issue affects unknown processing of the file Master.php?f=save_service in the HTTP POST Request Handler component, leading to SQL injection.

A flaw was found in the skcipher_recvmsg function in the Linux kernel’s interface for symmetric key cipher algorithms. This flaw allows a local user to crash the system.

A Cross-site Scripting (XSS) vulnerability, stored in the GitHub repository amauric/tarteaucitron.js prior to version 1.13.1. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the victim's browser context.

A critical vulnerability was found in SourceCodester Best POS Management System 1.0. It affects an unknown part of the file admin_class.php of the Login Page component, where manipulation of the 'username' argument leads to SQL injection.

xalpha version 0.11.4 is vulnerable to Remote Command Execution (RCE).

Version 2.15.0 of fast-poster is vulnerable to Cross Site Scripting (XSS). The file upload check only verifies binary image data but does not strictly check the file suffix, leading to stored XSS.

TwoNav version 2.0.28-20230624 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts in the user's browser context.

The wmanager version 1.0.7 and earlier has an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via a crafted script targeting the company.php component.

A vulnerability in Marukyu Line version 13.4.1 allows a remote attacker to access sensitive information via the channel access token in the miniapp function.

WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.

Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.

A buffer overflow vulnerability in the aswSnx.sys driver of Avast AntiVirus before version 19.7 allows a local attacker to cause a denial of service (DoS) via a crafted request.

CVE-2023-36690 identifies a Cross-Site Request Forgery (CSRF) vulnerability in the VibeThemes WPLMS theme versions up to 4.900. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user.