CVE Vulnerability Catalog

Piwigo version 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

Piwigo version 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the 'add tags' function.

Old Age Home Management version 1.0 is vulnerable to SQL Injection via the username parameter.

A command injection vulnerability exists in the Linksys E2000 router with firmware version 1.0.06. An attacker with web management privileges can inject commands into POST request parameters in the httpd Start_EPI() function, gaining shell access.

A command injection vulnerability exists in the Linksys E2000 router with firmware version 1.0.06. An attacker with web management privileges can inject commands into the POST request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.

A command injection vulnerability exists in the Linksys WRT54GL router with firmware version 4.30.18.006. An attacker with web management privileges can inject commands into POST request parameters in the httpd's Start_EPI() function, gaining shell access.

An issue was discovered in KaiOS 3.0 before 3.1 related to the /system/bin/tctweb_server binary that exposes a local web server. This server accepts arbitrary Bash commands and executes them as root, posing a serious security risk to the device.

An issue was discovered in KaiOS 3.0 and 3.1 where the binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed application. An attacker can make fetch requests to api-daemon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.

MXsecurity version 1.0 is vulnerable to hardcoded credential vulnerability. This vulnerability allows crafting arbitrary JWT tokens, enabling bypassing authentication for web-based APIs.

MXsecurity version 1.0 is vulnerable to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, allowing attackers with authorization privileges to break out of the restricted shell and execute arbitrary code.

Bitcoin Core before version 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) due to inefficient draining of the inventory-to-send queue, as exploited in the wild in May 2023.

An issue was discovered in the Linux kernel before version 6.2.9 related to a use-after-free in the bq24190_remove function in bq24190_charger.c. This could allow a local attacker to crash the system due to a race condition.

An issue was discovered in Qt versions 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1 related to QDnsLookup, allowing for a buffer over-read via a crafted reply from a DNS server.

The remote keyfob system on Nissan Sylphy Classic 2021 sends the same RF signal for each door-open request, allowing for a replay attack.

In Hazelcast versions 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines do not properly mask passwords in member configuration, allowing Hazelcast Management Center users to view some secrets.

There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain.

CVE-2023-33252 vulnerability in iden3 snarkjs up to version 0.6.11 allows double spending due to lack of validation that the publicSignals length is less than the field modulus.

Versions of Akka HTTP before 10.5.2 have a problem with the permissions of temporary files created during file uploads. These files have weak permissions, allowing other users to read them on Linux and UNIX systems.

Linux kernel 6.3 has a use-after-free vulnerability in the iopt_unmap_iova_range function in drivers/iommu/iommufd/io_pagetable.c.

Obsidian before 1.2.2 allows calls to unintended APIs (for microphone access, camera access, and desktop notification) via an embedded web page.