CVE Vulnerability Catalog

The Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 is vulnerable to XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.

A command injection vulnerability in the diag_backup.php component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.

Version 1.0.9 of the uthenticode library has a vulnerability that allows an attacker to modify code within a binary file without changing its Authenticode hash, violating the Authenticode specification.

CSZCMS version 1.3.0 has a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the p parameter or the search URL.

The vulnerability related to the use of a hard-coded cryptographic key in the Kunduz - Homework Helper app allows for authentication abuse and bypass. This issue affects versions of the app before 6.2.3.

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server through version 9.2.1.

Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before version 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.

The TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in the setStaticDhcpConfig function in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.

TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.

Improper input validation in Zoom Desktop Client for Windows before version 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.

A vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

A vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution. An attacker can exploit this flaw to take control of the system.

Path traversal in Zoom Desktop Client for Windows before version 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.

A vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

Elevation of privilege vulnerability in Microsoft Exchange Server. It allows an attacker to elevate their privileges in the system.

In SES versions 0.18.0 to 0.18.7, 0.17.0 to 0.17.1, 0.16.0 to 0.16.1, 0.15.0 to 0.15.24, 0.14.0 to 0.14.5, and 0.13.0 to 0.13.5, there is a vulnerability in the confinement of guest applications that may lead to information exfiltration or arbitrary code execution. This vulnerability can be exploited by programs running in Compartments that gain access to the host's dynamic import.

The a2 License Portal System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 1.48.

The a2 Camera Trap Tracking System before version 3.1905 has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands.