CVE Vulnerability Catalog

An issue in the GDKfree component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the gc_col component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the list_append component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the cs_bind_ubat component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the BLOBcmp component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the log_create_delta component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause Denial of Service (DoS) via crafted SQL statements.

An issue in the sql_trans_copy_key component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the rel_deps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the __nss_database_lookup component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

An issue in the rel_sequences component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

A vulnerability in the scaffolder-backend plugin of the Backstage platform allows for remote code execution by a malicious actor with access to a registered template. The issue arises from the use of a templating library that requires a sandbox, which permits code injection.

Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine.

Casdoor v1.331.0 and below was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in the /api/set-password endpoint. This vulnerability allows attackers to arbitrarily change the victim user's password by supplying a crafted URL.

The Kanban Boards plugin for WordPress versions up to 2.5.20 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of administrative users.

The Marco Milesi Telegram Bot & Channel plugin versions up to 3.6.2 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.

The Robin Wilson bbp style pack plugin versions <= 5.5.5 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The ARMember plugin versions up to 4.0.2 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.

In Vaadin, in many versions, a vulnerability allows information disclosure of class and method names in RPC responses by sending modified requests.

In Vaadin, adding non-visible components to the UI on the server side causes their content to be sent to the browser, potentially leading to information disclosure. Affected versions include 10.0.0-10.0.22, 11.0.0-14.10.0, 15.0.0-22.0.28, 23.0.0-23.3.12, 24.0.0-24.0.5, and 24.1.0.alpha1-24.1.0.beta1.

Wtyczka RapidLoad Power-Up dla Autoptimize w wersjach do 1.6.35 zawiera podatność na wstrzykiwanie SQL (SQLi) związaną z autoryzacją (subscriber+). Atakujący może wykorzystać tę lukę do wykonania nieautoryzowanych zapytań do bazy danych.