CVE Vulnerability Catalog

Wtyczka Sneeit Framework dla WordPressa jest podatna na zdalne wykonanie kodu we wszystkich wersjach do i włącznie z 8.3, poprzez funkcję sneeit_articles_pagination_callback(). Problem wynika z akceptacji danych wejściowych od użytkownika, które są następnie przekazywane do call_user_func().

In Application Server of Desktop Alert PingAlert (versions 6.1.0.11 to 6.1.1.2), a Directory Traversal vulnerability allows an attacker to write arbitrary files under certain conditions.

In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has spaces and is not surrounded by quotation marks. An adversary can place an executable in a higher-level directory, and Windows will resolve that executable instead of the intended one.

Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in name and uploadDir parameters and saves the file without adequate validation, allowing remote code execution.

Shenzhen TVT Digital Technology NVMS-9000 firmware contains hardcoded API credentials and an OS command injection flaw in its configuration services. An unauthenticated remote attacker can exploit these to access endpoints and execute arbitrary commands as root.

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) accessible without authentication. This endpoint leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters.

Fluent Bit input plugins (in_http, in_splunk, in_elasticsearch) fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters like newlines or ../ that are treated as valid tags.

In the Linux kernel, a refcount leak in nfsd_set_fh_dentry() occurs when an NFSv3 (or v2) client uses a pseudo-root filehandle. The export is stored in svc_fh but the reference is dropped, leading to a double free and potential use-after-free.

Podatność w narzędziu md-to-pdf przed wersją 5.2.5 pozwala na wykonanie dowolnego kodu zdalnego poprzez blok front-matter w Markdown zawierający delimiter JavaScript. Wykorzystanie tej luki może prowadzić do nieautoryzowanego dostępu do systemu.

hpke-js to moduł Hybrydowego Szyfrowania Klucza Publicznego (HPKE) oparty na API kryptografii internetowej. Przed wersją 1.7.5, publiczna metoda Seal() w SenderContext miała warunek wyścigu, co pozwalało na wielokrotne użycie tego samego nonce AEAD dla różnych wywołań Seal().

MLX, an array framework for machine learning on Apple silicon, prior to version 0.29.4 has a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. An attacker-controlled file causes a 13-byte out-of-bounds read, leading to crash or information disclosure.

In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which could allow overriding internal user IDs and lead to impersonation or privilege escalation.

Wtyczka Mstoreapp Mobile App dla WordPressa w wersjach do 2.08 oraz Mstoreapp Mobile Multivendor do 9.0.1 nie weryfikuje poprawnie tożsamości użytkowników podczas korzystania z akcji AJAX. Umożliwia to nieautoryzowanym użytkownikom uzyskanie ważnej sesji dla dowolnych użytkowników, znając ich adres e-mail.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This allows unauthenticated attackers to upload arbitrary files on the server, potentially leading to remote code execution.

EPSON WebConfig oraz Epson Web Control dla produktów projektorów SEIKO EPSON nie ograniczają nadmiernych prób uwierzytelnienia. Hasło użytkownika administracyjnego może zostać ujawnione w wyniku ataku typu brute force.

The AuthKit library for Next.js in version 2.11.0 and below does not defensively apply anti-caching headers to authenticated responses. In environments with CDN caching enabled, this can result in session tokens being included in cached responses and served to multiple users.

Claude Code, an agentic coding tool, prior to version 2.0.31 has an error in sed command parsing that allows bypassing the read-only validation and writing to arbitrary files on the host system.

Microsoft SharePoint Online has an elevation of privilege vulnerability.

Azure Bastion has an elevation of privilege vulnerability.

The university-bbs (Blogin) system has a weak verification code generation mechanism and lacks rate limiting. This allows an attacker to perform brute-force attacks on verification codes without authentication. Successful exploitation may lead to account takeover via password reset or other authentication bypass methods.