CVE Vulnerability Catalog

SAP CRM ABAP in versions 700, 701, 702, 712, 713, 714 does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on the confidentiality and integrity of the application.

SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.

SAP NetWeaver (Design Time Repository) version 7.50 returns an unfavorable content type for some versioned files, which could allow an authorized attacker to create a file with malicious content and send a link to a victim in an email or instant message. Under certain circumstances, this could lead to a Cross-Site Scripting vulnerability.

Wtyczka WP Directory Kit dla WordPressa jest podatna na atak Local File Inclusion w wersjach do 1.1.9 włącznie, poprzez funkcję 'wdk_public_action'. Umożliwia to nieautoryzowanym atakującym dołączanie i wykonywanie dowolnych plików na serwerze, co pozwala na wykonanie kodu PHP w tych plikach.

A use after free issue was discovered in the Linux Kernel in the outbound_phy_packet_callback function in the driver/firewire module. A local attacker with special privileges may cause a use after free problem when queue_event() fails.

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel, occurring when font->width and font->height values greater than 32 are provided. The lack of checks leads to a shift-out-of-bounds, resulting in undefined behavior and possible denial of service.

Asus RT-N10LX Router v2.0.0.39 was found to have a stack overflow vulnerability via the mac parameter at /start-apply.html. This vulnerability only affects products that are no longer supported by the maintainer.

A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text field.

Asus RT-N10LX Router v2.0.0.39 was found to contain a stack overflow via the url parameter at /start-apply.html. This vulnerability only affects products that are no longer supported by the maintainer.

D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary.

A command injection vulnerability was discovered in D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 via the ST parameter in the lxmldbc_system() function.

AMI BMC contains a vulnerability in the SPX REST API that allows an attacker with the required privileges to inject arbitrary shell commands. This may lead to code execution, denial of service, information disclosure, or data tampering.

AMI BMC contains a vulnerability in the IPMI handler, allowing an attacker to upload and download arbitrary files under certain circumstances. This may lead to denial of service, privilege escalation, information disclosure, or data tampering.

AMI BMC contains a vulnerability in the IPMI handler that allows an attacker with the required privileges to cause a buffer overflow. This may lead to code execution, denial of service, or escalation of privileges.

AMI BMC contains a vulnerability in the IPMI handler, allowing an unauthenticated host to write to a host SPI flash, bypassing secure boot protections. Exploitation of this vulnerability may lead to loss of integrity or denial of service.

AMI BMC contains a vulnerability in the SPX REST API that allows an attacker with the required privileges to inject arbitrary shell commands. This may lead to code execution, denial of service, information disclosure, or data tampering.

AMI BMC contains a vulnerability in the SPX REST API, allowing an attacker with the required privileges to access arbitrary files, which may lead to information disclosure.

AMI BMC contains a vulnerability in the IPMI handler, allowing an unauthorized attacker to use certain oracles to guess a valid username, which may lead to information disclosure.

AMI BMC contains a vulnerability in the SPX REST API, allowing an attacker with the required privileges to read and write to arbitrary locations within the memory context of the IPMI server process. This may lead to code execution, denial of service, information disclosure, or data tampering.

Doorkeeper, an OAuth 2 provider for Ruby on Rails / Grape, prior to version 5.6.6 automatically processes authorization requests without user consent for previously approved public clients. This creates a risk of impersonation.