CVE Vulnerability Catalog

A weakness has been identified in light0011 cms in the file App/Home/Model/UserModel.class.php of the Cookie Helper component. Manipulation of the Username argument leads to improper authentication. The attack can be performed remotely, and the exploit is publicly available.

A security flaw has been discovered in light0011 cms in the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Manipulation results in unrestricted upload. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was determined in 92181 markdown up to version 058cab0cb7fb245a0ccc6b8446963ff8d573558f. The function lds in file md.c is affected. Manipulation can lead to out-of-bounds read. The attack can be executed remotely. A patch is available as c000d2f9cf390c315378d3717cf20911cf3e80a6.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

The User Profile Builder plugin for WordPress up to version 3.15.7 is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an OS Command Injection vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

PocketMine-MP before versions 3.26.5 and 4.0.5 fails to validate the length of skin data fields submitted by players, allowing values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized fields like skinID or geometryName to trigger exceptions during NBT serialization, causing server crashes.

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via checkSecurity()/isTrustedType(). However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes, meaning all classes are deserializable by default.

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.

A vulnerability was discovered in SourceCodester Class and Exam Timetabling System 1.0 in an unknown function of the file /delete_subject.php. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been publicly released.

A vulnerability was identified in D-Link DIR-605 B1v202WWB03 in the tunnel_set_params function of the file progs.gpl/pppd.alpha/l2tp/tunnel.c in the L2TP Control Message Parser component. Manipulation of the argument peer_hostname leads to an off-by-one error. The attack may be performed remotely but is highly complex and difficult to exploit. The exploit is publicly available.

A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0 in an unknown function of the file saveuser.php in the User Creation component. Manipulation of the argument position results in missing authentication. The attack may be initiated remotely and the exploit is now public.

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with restricted access can submit a CompleteStateRequest or UpdateStateRequest with an empty field mask, which may be incorrectly authorized, allowing read of the complete cluster state or modification outside its authorized subtree.

A weakness has been identified in SourceCodester Online Voting System 1.0 affecting an unknown function of the file /voting/ajax.php?action=save_category. Manipulation of the argument Category causes SQL injection. The attack can be initiated remotely and the exploit has been made public.