CVE Vulnerability Catalog

The Joomla! Component JB Visa version 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the visatype parameter. Attackers can send GET requests to index.php with the option=com_bookpro and view=popup parameters, injecting SQL commands in the visatype parameter to extract sensitive database information including credentials and table contents.

Joomla! Component User Bench version 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with parameters that enable SQL injection payloads.

The My Projects 2.0 component in Joomla! contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.

Joomla NextGen Editor version 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname parameter. Attackers can send GET requests to index.php with option=com_nge&view=config and inject malicious SQL code in the plname parameter to extract sensitive database information.

A vulnerability was found in the Linux kernel's BPF reuseport group mechanism. The cBPF program was freed immediately without waiting for the RCU grace period, leading to an out-of-bounds read (use-after-free) in reuseport_select_sock during socket selection.

In the Linux kernel, a vulnerability was found in the ip6_vti driver where the fallback device (ip6_vti0) does not have the netns_immutable flag set. Other similar tunnel drivers (e.g., ip6_tunnel, sit) correctly set this flag to prevent the device from being moved to another network namespace.

In the Linux kernel, a vulnerability was found in the MR re-registration mechanism in RDMA drivers. When changing access permissions from read-only (RO) to read-write (RW), the consistency of the user memory mapping (umem) was not verified, potentially leading to improper page pinning.

AVAST Antivirus version 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges.

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files (x86)\Personify\ can place a malicious Program.exe or PsyFrameGrabberService.exe file that executes with LocalSystem privileges when the service starts automatically at boot.

Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting malicious code into the system root path. Attackers can place executable files in unquoted path directories that execute with LocalSystem privileges during service startup or system reboot.

Brother SAPSprint version 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Attackers can place a malicious executable in the Program Files directory path to be executed with LocalSystem privileges when the service starts automatically.

Wondershare PDFelement version 5.2.9 contains a privilege escalation vulnerability due to an unquoted service path in the WsAppService. Local attackers can place a malicious executable in the service path and execute code with LocalSystem privileges upon service restart or system reboot.

Winstep 18.06.0096 contains an unquoted service path vulnerability in the Winstep Xtreme Service that allows local attackers to escalate privileges. Attackers can place malicious executables in the Program Files directory to be executed with LocalSystem privileges when the service starts.

Realtek Audio Service version 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code.

RealTimes Desktop Service version 18.1.4 contains an unquoted service path vulnerability in the rpdsvc.exe binary that allows local attackers to escalate privileges. Attackers can place malicious executables in unquoted path directories to execute arbitrary code with LocalSystem privileges during service startup or system reboot.

TFTP Broadband version 4.3.0.1465 contains an unquoted service path vulnerability in the tftpt.exe service binary that allows local attackers to execute arbitrary code with system privileges. Attackers can place a malicious executable in the Program Files directory path that will be executed during service startup or system reboot with LocalSystem privileges.

Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path, allowing local attackers to escalate privileges by placing malicious executables in intermediate directories. Attackers can exploit the unquoted path in the service configuration to execute arbitrary code with LocalSystem privileges when the service starts or restarts.

Matrix42 Remote Control Host version 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that allows local users to execute arbitrary code with SYSTEM privileges.

AnyDesk version 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during application startup or system reboot.

Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29 contain unquoted service path vulnerabilities in WiseBootAssistant and SpyHunter 4 Service, allowing local users to execute arbitrary code with SYSTEM privileges.