CVE Vulnerability Catalog

A regression in the fix for bug 66512 in Apache Tomcat causes that if a response does not include any HTTP headers, no AJP SEND_HEADERS message will be sent. This leads to at least one AJP proxy (mod_proxy_ajp) using the response headers from the previous request, resulting in an information leak.

Apache Accumulo 2.1.0 has an improper authentication vulnerability that may allow successful authentication with invalid credentials. Users are advised to upgrade to 2.1.1.

A critical vulnerability has been found in Agro-School Management System version 1.0. Manipulation of the test_id argument in the exam-delete.php file leads to SQL injection, which can be exploited remotely.

Netgear R6250 firmware version 1.0.4.48 is vulnerable to buffer overflow after authentication.

An issue was discovered in the Linux kernel through 6.1-rc8 related to the lack of checking the return value of kzalloc() in dpu_crtc_atomic_check, leading to a NULL Pointer Dereference.

CloudPanel 2 before version 2.3.1 has insecure cookie authentication in the file manager.

XWiki Platform is a generic wiki platform that allows executing any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This issue has been patched in XWiki versions 15.1-rc-1 and 14.10.5.

Enphase Envoy version D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.

A critical vulnerability was found in SourceCodester Online School Fees System version 1.0. The issue affects some unknown functionality of the file ajx.php in the GET Parameter Handler component, where manipulation of the argument name_startsWith leads to SQL injection.

Adiscon LogAnalyzer v4.1.13 and earlier is vulnerable to SQL Injection.

Langchain version 0.0.171 is vulnerable to arbitrary code execution in the load_prompt function.

The Flothemes Flo Forms plugin versions up to 1.0.40 contains a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of administrative users.

A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.

A vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message.

Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection.

A critical vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It affects an unknown functionality of the file /admin/reg.php of the Admin Registration component, leading to improper authentication.

Zoho ManageEngine ADSelfService Plus through version 6113 has an authentication bypass vulnerability that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving domain controller administrator privileges.

The John Brien WordPress NextGen GalleryView plugin versions <= 0.5.5 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The WP Affiliate Links plugin versions up to 0.1.1 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.