CVE Vulnerability Catalog

Due to a programming error in function module and report, the IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.

Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain classes that cannot be deserialized, which could allow an attacker to remotely execute arbitrary code.

A stack overflow was discovered in the page parameter in the fromSetIpBind function in Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408).

A stack overflow was discovered in the deviceId parameter in the saveParentControlInfo function in Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47.

Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk_crypto parameter in the fromSetWirelessRepeat function.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromVirtualSer function via the page parameter.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromAddressNat function, caused by the entrys parameter.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromAddressNat function via the page parameter.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability via the deviceId parameter in the formSetClientState function.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability via the speed_dir parameter in the formSetSpeedWan function.

Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the formSetDeviceName function via the deviceId parameter.

The Tenda FH1203 V2.0.1.6 device was found to contain a stack overflow vulnerability in the addWifiMacFilter function related to the deviceId parameter.

Version V2.0.1.6 of the Tenda FH1203 has a stack overflow vulnerability via the ssid parameter in the form_fast_setting_wifi_set function.

XWiki Platform has a vulnerability that allows remote code execution via a cross-site request forgery (CSRF) attack using the REST API. Exploitation of this flaw by a user with programming rights can impact the integrity, availability, and confidentiality of the entire XWiki installation.

The MStore API WordPress plugin before 3.9.8 does not sanitize and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features and uses the woocommerce-appointments plugin.

The MStore API WordPress plugin before version 3.9.9 allows visitors to create user accounts with any role via its REST API endpoint. This is only exploitable if the site owner paid for access to the plugin's pro features.

CVE-2023-3045 describes an improper neutralization of special elements used in an SQL command, leading to SQL Injection in the Tise Technology Parking Web Report application in versions prior to 2.1.

Projectworlds Online Art Gallery Project version 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. There is a dispute regarding the validity of this vulnerability.

CVE-2023-2852 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Softmed SelfPatron versions before 2.0.