CVE Vulnerability Catalog

Delta Electronics DIAView posiada wiele podatności, które mogą wpływać na bezpieczeństwo systemu. Wykorzystanie tych luk może prowadzić do nieautoryzowanego dostępu lub innych niepożądanych działań.

Delta Electronics DIAView posiada wiele podatności, które mogą wpływać na bezpieczeństwo systemu. Wykorzystanie tych luk może prowadzić do nieautoryzowanego dostępu lub innych zagrożeń.

The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server.

Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Buffer overflow vulnerability in Address Book attribute tag processing on small office multifunction printers. An attacker on the network segment can cause the device to become unresponsive or execute arbitrary code.

Buffer overflow vulnerability in XPS font fpgm data processing on small office multifunction printers and laser printers. An attacker on the network segment can cause the device to become unresponsive or execute arbitrary code.

Buffer overflow vulnerability in CPCA list processing on small office multifunction printers and laser printers. An attacker on the network segment can cause the device to become unresponsive or execute arbitrary code.

Invalid free vulnerability in CPCA file deletion processing on small office multifunction printers and laser printers. An attacker on the network segment can cause the device to become unresponsive or execute arbitrary code.

Buffer overflow vulnerability in XML processing of XPS files on small office multifunction printers and laser printers. An attacker on the network segment can cause the device to become unresponsive or execute arbitrary code.

Buffer overflow vulnerability in print job processing by WSD on small office multifunction printers and laser printers. An attacker on the network segment can cause the device to become unresponsive or execute arbitrary code.

GravCMS w wersji 1.10.7 zawiera podatność, która pozwala nieautoryzowanym atakującym na zapis dowolnych konfiguracji YAML oraz wykonanie kodu PHP poprzez punkt końcowy harmonogramu. Atakujący mogą wykorzystać parametr admin-nonce do wstrzykiwania ładunków zakodowanych w base64 i tworzenia złośliwych zadań z wykonaniem poleceń systemowych.

Grocery Crud w wersji 1.6.4 zawiera podatność na wstrzykiwanie SQL w parametrze order_by, co umożliwia zdalnym atakującym manipulację zapytaniami do bazy danych. Atakujący mogą wstrzykiwać złośliwy kod SQL przez parametr order_by[] w żądaniach POST do punktu końcowego ajax_list, co może prowadzić do wyciągania lub modyfikacji informacji w bazie danych.

NoteBurner w wersji 2.35 zawiera podatność na przepełnienie bufora w polu wejściowym kodu licencyjnego, co pozwala atakującym na awarię aplikacji. Atakujący mogą wygenerować 6000-bajtowy ładunek i wkleić go w pola 'Nazwa' i 'Kod', co prowadzi do awarii aplikacji.

Ether MP3 CD Burner w wersji 1.3.8 zawiera podatność typu buffer overflow w polu nazwy rejestracyjnej, co umożliwia zdalne wykonanie kodu. Atakujący mogą stworzyć złośliwy ładunek, aby nadpisać obsługiwacze SEH i uruchomić bind shell na porcie 3110, wykorzystując niewłaściwą walidację danych wejściowych.

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post.

A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 through 7.8 SP1 could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gain unauthorized access to user or admin accounts.

A .NET deserialization vulnerability in Changjetong T+ up to version 16.x in an AjaxPro endpoint can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start.

An arbitrary file upload vulnerability in Uploadify WordPress plugin up to version 1.0 due to missing file type validation in process_upload.php. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.

Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint.

Entrust Instant Financial Issuance (IFI) On Premise (formerly CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to read arbitrary files from the server and coerce outbound authentication, and may achieve arbitrary file write and remote code execution via known .NET Remoting exploitation techniques.