CVE Vulnerability Catalog

CVE-2023-36217 is a Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 that allows a remote attacker to execute arbitrary code via the category name field of the image manager function.

MotoCMS version 3.4.3 contains an SQL injection vulnerability that allows a remote attacker to gain privileges via the keyword parameter of the search function.

CVE-2023-3346 in MITSUBSHI CNC Series has a buffer overflow vulnerability that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition and execute arbitrary code on the device by sending specially crafted packets. A system reset is also required for recovery.

A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.

In WS-Inc J WBEM Server version 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service.

A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.

A vulnerability in the GatesAir Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to obtain LDAP and SMTP credentials, potentially leading to privilege escalation.

IDSecure version 4.7.26.0 and prior uses a hardcoded cryptographic key to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.

A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.

User enumeration is found in PHP Jabbers Time Slots Booking Calendar v3.3. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

Improper input validation of the password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords.

MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keyword parameter.

The Ajaxmanager File and Database explorer module for PrestaShop through version 2.3.0 has an Unrestricted Upload of File with Dangerous Type vulnerability. This allows remote attackers to upload dangerous files without restrictions.

Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Memory safety bugs exist in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.

Memory safety bugs are present in Firefox and Thunderbird that may lead to memory corruption. Some of these bugs could potentially be exploited to run arbitrary code.

A command injection vulnerability in the wsConvertPpt component of Chamilo versions 1.11.* through 1.11.18. An attacker can execute arbitrary system commands via a SOAP API call with a crafted PowerPoint filename.

BMC Control-M versions up to 9.0.20.200 are vulnerable to SQL injection via the report-id parameter in the /RF-Server/report/deleteReport request. This issue is fixed in version 9.0.21 and also by a patch for version 9.0.20.200.

Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.

Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.