CVE Vulnerability Catalog

In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escalation of privilege without additional execution privileges. User interaction is not required for exploitation.

In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

SQL Injection vulnerability in WP AutoSuggest 0.24, allowing unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the wpas_keys parameter. Attackers can send GET requests to autosuggest.php.

SQL Injection vulnerability in Joomla component JE Photo Gallery 1.1, allowing unauthenticated attackers to extract database information by injecting SQL code into the categoryid parameter. Attackers can send GET requests to index.php.

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft a malicious input file with a 672-byte offset to overwrite nSEH and SEH pointers.

No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint. Authenticated attackers can send POST requests to /nocms/main/manage_privilege/index/export with malicious SQL code in the order_by[0] parameter to extract sensitive database information.

Paroiciel 11.20 contains an SQL injection vulnerability in the eGeqIdEquipe parameter. Authenticated attackers can send GET requests to egeq.php with crafted SQL payloads to extract sensitive database information, including version details.

Paroiciel 11.20 contains an SQL injection vulnerability in the zProIdPro parameter. Authenticated attackers can send GET requests to zpro.php with crafted SQL payloads to extract sensitive database information, including usernames, databases, and version details.

SQL Injection vulnerability in Paroiciel 11.20, allowing unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the tRecIdListe parameter. Attackers can send GET requests to trec.php.

SSRF vulnerability in Nanobot prior to version 0.2.1 in the Microsoft Teams channel handler. A remote attacker can forge an activity with a controlled serviceUrl value, leading to exfiltration of Bot Framework bearer tokens.

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator.

CodexBar before version 0.32.0 contains an insecure temporary file handling vulnerability. A local attacker can read the App Store Connect API key written to a fixed path, create symbolic links at predictable locations to redirect writes, or tamper with notarization archives before submission.

CodexBar before version 0.32.0 contains a privilege escalation vulnerability in the CLI installer, allowing local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges, allowing a local process to overwrite the installer body before the administrator prompt is approved.

FlexRIC v2.0.0 allows binding multiple xapp_ids to a single SCTP connection by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up, leaving stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption.

Kiteworks prior to version 9.3.0 has a reflected XSS vulnerability in Secure Data Forms, allowing an external attacker to trick a user into executing arbitrary JavaScript code. Fixed in version 9.3.0.

In code-projects Hotel and Tourism Reservation System 1.0, the password_verify function in /admin/login.php improperly authenticates the Password argument, leading to improper authentication. The attack is remotely exploitable. The exploit is public.

In SourceCodester SEO Meta Tag Extractor 1.0, the get_headers function in /index.php is vulnerable to server-side request forgery (SSRF) via manipulation of the url argument. The attack can be executed remotely and the exploit has been made public.

lwext4 1.0.0 has a NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h. An attacker can supply a specially crafted EXT4 filesystem image with malformed directory entries, causing a segmentation fault (DoS).

Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN apertures leading to a potential escalation of privileges.