CVE Vulnerability Catalog

A vulnerability in Printix Secure Cloud Print Management up to version 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation due to a race condition.

A remote code execution vulnerability exists in KeyMouse Windows version 3.08 and prior during an unauthenticated update. Exploitation requires the user to trigger an update of an affected KeyMouse installation.

The Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, allowing unprivileged local users to elevate privileges to SYSTEM via the 'Browse For Folder' window accessible by triggering a repair on the MSI package located in C:\Windows\Installer.

YzmCMS v6.3 is affected by a broken access control vulnerability that allows unauthorized access to users' personal home pages without login. The issue arises from missing authentication checks before accessing the home page, enabling attackers to view other users' pages while not logged in.

Wykryto podatność typu przepełnienie sterty w bluez w wersjach przed 5.63. Atakujący z dostępem do lokalnej sieci mógł przesłać specjalnie przygotowane pliki, co mogło spowodować zatrzymanie lub awarię aplikacji, prowadząc do odmowy usługi.

SmartBear CodeCollaborator version 6.1.6102 contains a vulnerability in the web UI that allows a clickjacking attack. An attacker can trick a user into clicking a seemingly harmless element, performing unauthorized actions.

A NULL pointer dereference flaw in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux kernel, requiring CAP_SYS_ADMIN, allows a local attacker to crash the system or leak kernel internal information. The highest threat is to system availability.

Występuje podatność CWE-287: Niewłaściwa autoryzacja, która może umożliwić atakującemu dowolną zmianę zachowania UPS, gdy klucz zostanie ujawniony i użyty do przesłania złośliwego oprogramowania. Dotyczy to rodziny APC Smart-UPS, w tym serii SMT, SMC, SCL, SMX oraz SRT.

A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.

A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to execute malicious code on the victim's system.

A vulnerability in VP9 video extensions allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.

.NET and Visual Studio contain a Denial of Service (DoS) vulnerability that can lead to service unavailability.

A vulnerability in Microsoft Office Visio allows for remote code execution. An attacker can exploit this flaw to take control of the victim's system.

The vulnerability in HEIF image extensions allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.

A vulnerability in VP9 video extensions allows for remote code execution. An attacker can exploit this flaw to gain control over the victim's system.

A vulnerability in Paint 3D allows for remote code execution, potentially leading to unauthorized access to the user's system. An attacker can exploit this flaw to run malicious software on the compromised device.

Wtyczka WP Visitor Statistics (Real Time Traffic) dla WordPressa w wersjach przed 5.6 nie sanitizuje i nie ucieka parametru id przed użyciem go w zapytaniu SQL za pośrednictwem akcji AJAX refUrlDetails, dostępnej dla każdego uwierzytelnionego użytkownika, co prowadzi do podatności na wstrzyknięcie SQL.

In the Linux kernel's NFC driver st21nfca (drivers/nfc/st21nfca/se.c), the function st21nfca_connectivity_event_received has buffer overflows in EVT_TRANSACTION due to untrusted length parameters. The vulnerability affects versions up to 5.16.12.