CVE Vulnerability Catalog

An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.

CVE-2023-37245 describes a buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.

Vulnerability in the atcmdserver module allows interception of commands from the modem. Attackers may exploit this vulnerability to rewrite NVRAM or facilitate the exploitation of other vulnerabilities.

Vulnerability related to missing input length verification in the distributed file system. Successful exploitation of this vulnerability may lead to out-of-bounds read.

A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4). An attacker could exploit this vulnerability to gain unauthorized access to the MOVEit Transfer database.

Versions of protobuf.js (protobufjs) from 6.10.0 to 7.x before 7.2.5 are vulnerable to Prototype Pollution. An attacker can exploit a user-controlled protobuf message to modify the Object.prototype, allowing for the addition and overwriting of data and functions.

Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.

The Ultimate Member WordPress plugin before version 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.

An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.

CVE-2023-35797 describes an improper input validation vulnerability in Apache Airflow Hive Provider before version 6.1.1. This allows bypassing security checks and remote code execution (RCE) via the principal parameter.

OpenTSDB, an open-source, distributed time series database, is vulnerable to remote code execution by writing user-controlled input to a Gnuplot configuration file and running Gnuplot with the generated configuration.

There is an SQL Injection vulnerability in the GitHub repository fossbilling/fossbilling prior to version 0.5.3.

XWiki Platform allows users with edit rights to modify all pages in the `CKEditor` space, which can lead to the removal of technical documents and editing the JavaScript configuration of CKEditor, resulting in persistent XSS.

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3, where an attempt to block a user fails after a temporary browser hang, resulting in a DBQueryDisconnectedError error message.

Certain HP LaserJet Pro print products are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function.

Wtyczka BookIt dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 2.3.7 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas rezerwacji wizyty przez wtyczkę.

XWiki Platform allows attackers to inject XWiki syntax and Velocity code by editing documents with an icon set, leading to remote code execution. Various attack vectors, including the use of the icon set in HTML, can be exploited.

XWiki Platform allows users to edit their profiles and notification settings, enabling the execution of arbitrary script macros, including Groovy and Python, leading to remote code execution. Versions 14.10.6 and 15.2RC1 contain patches for this vulnerability.

A vulnerability in XWiki Platform allows remote code execution even after upgrading to a version that includes fixes. The issue arises when old document versions containing vulnerabilities are not removed from history, allowing for their reuse.