CVE Vulnerability Catalog

Vulnerability in Windows Secure Kernel Mode due to improper validation of input consistency. An authenticated attacker can elevate privileges locally.

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

Vulnerability in Windows App Store due to a race condition in concurrent resource access. An unauthenticated attacker over the network can elevate privileges.

Relative path traversal vulnerability in Windows PowerShell allows an authorized attacker to execute code remotely.

Memory allocation with excessive size vulnerability in Windows LSASS. An unauthorized attacker can remotely cause a denial of service.

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/userproductdeletequery.php. Manipulating the user_id argument allows remote attack. The exploit is publicly available.

A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data.

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker with access to the relevant HTTP interface can inject shell metacharacters, leading to arbitrary code execution with root privileges.

An OS command injection vulnerability exists in the TR-069/CWMP management interface of Archer VX1800v v1 due to insufficient input validation, allowing crafted input to be executed as system-level commands.

A vulnerability in CompactLogix 5380, ControlLogix 5580, and EN4 communication modules involves improper rejection of certificates signed by a revoked intermediate certificate. The controller fails to validate CRLs correctly, allowing an attacker to establish a connection with a certificate that should be untrusted.

A Stored Cross-Site Scripting vulnerability exists in FactoryTalk® DataMosaix™ Private Cloud due to improper neutralization of user-supplied input in Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts permanently stored on the server, leading to JavaScript execution when other users access the affected page.

A code execution vulnerability exists in Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. Executable paths containing spaces are not properly quoted, allowing an attacker to place a malicious executable earlier in the search order and achieve arbitrary code execution.

A remote code execution vulnerability exists in Studio 5000 Logix Designer due to incorrect authorization on a configuration file. Any authenticated user can modify the paths of external tools configured within the application. An attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

A path traversal vulnerability exists in Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during project opening, allowing path traversal sequences. Exploitation could allow an attacker to write arbitrary files to attacker-controlled locations, potentially leading to code execution.

In Roundcube Webmail before versions 1.6.17 and 1.7.2, insufficient CSS sanitization in HTML email messages may lead to SSRF or information disclosure when stylesheet links point to local network hosts.

Vulnerability in DBI::ProfileData for Perl before version 1.651 does not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser, and an unbounded value allows an attacker to specify a large index and consume available memory.

A vulnerability in Fortinet FortiSIEMWindowsAgent versions 7.4.0 through 7.4.1 is due to improper restriction of communication channel to intended endpoints. This could allow an attacker to escalate privileges.

A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.

A vulnerability in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8 allows an unauthenticated attacker to access the VNC server of scanning VMs. The issue is due to improper resource access restrictions.

A vulnerability in the Pillow Python imaging library allows controlled native heap corruption via the ImageCms.ImageCmsTransform.apply(im, imOut) API when the output image mode does not match the declared transform output mode. This issue is fixed in version 12.3.0.