CVE Vulnerability Catalog

The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability due to improper handling of parameter list and bindnum at the /goform/SetIpMacBind endpoint.

The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetVirtualServerCfg.

The Tenda AC8 v4 device has a stack overflow vulnerability due to improper handling of the parameter list at the endpoint /goform/SetStaticRouteCfg.

The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the time parameter at /goform/PowerSaveSet.

The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the parameters schedStartTime and schedEndTime at /goform/openSchedWifi.

The Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn device was found to contain a stack overflow vulnerability via the firewallEn parameter at the /goform/SetFirewallCfg endpoint.

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.

XWiki Platform has a vulnerability that allows remote code execution by an attacker with edit rights on the wiki. It exploits a flaw in the job scheduler and an issue with content author authorization. This vulnerability has been patched in XWiki versions 14.10.9 and 15.4RC1.

XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.

A stack-based buffer overflow exists in Juplink RX4-1500, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root.

XWiki Platform allows registered users to execute arbitrary scripts in the content field of their profile page, leading to rights escalation. This issue has been present since version 4.3M2 when support for the content field was added in the AppWithinMinutes application.

XWiki Platform has a stored XSS vulnerability that can be exploited by registered users by setting a malicious payload in the time zone user preference. Although the time zone is selected from a dropdown, it can still be set using JavaScript or the appropriate URL.

A vulnerability in the Silicon Labs Gecko Bootloader on ARM allows code injection and authentication bypass due to a buffer overflow and out-of-bounds write issue. This affects both 'Standalone' and 'Application' versions of the bootloader.

The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This allows unauthenticated attackers to specify their user role by supplying the 'role' parameter during registration.

Version 0.0.171 of the langchain library contains a vulnerability that allows a remote attacker to execute arbitrary code via a JSON file used in load_prompt. This issue is related to __subclasses__ or a template.

In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.

A stack overflow vulnerability exists in ash.c:6030 in busybox before version 1.35. In the Internet of Vehicles environment, it can be exploited from command execution to arbitrary code execution.

An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse, located in the function parseit. This may lead to memory corruption when processing input data.

Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.

Version 0.8.0 and earlier of the pandasai library by Gaberiele Venturi contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.