CVE Vulnerability Catalog

In OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer) before version 12.7, a remote user with any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin.

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. An attacker can send a single attack payload over TCP, causing an infinite loop in which the server continuously reparses that payload and does not respond to any other requests.

There is a Session Fixation vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.

There is a code injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.1.

XWiki Platform has a vulnerability allowing for XSS attacks by injecting JavaScript through a forged URL. This can be exploited using the previewactions template, potentially executing unauthorized code on the page.

XWiki Platform allows users to forge URLs with payloads, enabling JavaScript injection on the page (XSS). The DeleteApplication page can be exploited to perform an XSS attack using a specially crafted URL.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript code through forged URLs. Exploiting the resubmit template enables the execution of malicious code, potentially leading to user data exposure.

XWiki Platform allows users to forge URLs with payloads that enable JavaScript injection on the page (XSS). The deletespace template can be exploited to perform an XSS attack, for example using the URL: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain).

The XWiki Platform has a vulnerability that allows the injection of JavaScript (XSS) through a forged URL. Users can exploit the restore template to perform an XSS attack, potentially leading to unauthorized access to data.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript through a forged URL. Exploiting the delete template enables XSS attacks, which may lead to unauthorized access to user data.

XWiki Platform has a XSS vulnerability that allows users to inject JavaScript through forged URLs. An example URL can execute an `alert` command in the browser, potentially leading to unauthorized access to user data.

The Elenos ETG150 FM transmitter running version 3.12 was found leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases.

The vulnerability in the Elenos ETG150 FM transmitter running version 3.12 stems from improper access control, allowing the addition of a high-privilege user by exploiting the user's role within the admin profile. The attack can be carried out over the public internet in some cases.

A use-after-free flaw was found in mt7921_check_offload_capability in the Linux Kernel's mt76/mt7921 component. This flaw could allow an attacker to crash the system after 'features' memory release.

XWiki Platform has a stored cross-site scripting (XSS) vulnerability that can be exploited by users with edit rights. Versions from 5.4.4 up to but not including 14.4.8, 14.10.4, and 15.0 are affected.

Improper access control in Elenos ETG150 FM transmitter version 3.12 allows privilege escalation by exploiting user roles in the user profile. The attack can be carried out over the public internet in some cases.