CVE Vulnerability Catalog

There is a vulnerability in the Notepad app related to improper permission control. Successful exploitation of this vulnerability may lead to privilege escalation, affecting availability and confidentiality.

CVE-2023-2907 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in the Marksoft application.

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Memory safety bugs exist in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.

In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.

In Siren Investigate versions before 13.2.2, session keys remain active even after logging out.

A buffer overflow in Nintendo Mario Kart Wii versions RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet.

A buffer overflow in Counter-Strike allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.

In Suricata before version 6.0.13, an adversary controlling an external source of Lua rules may be able to execute Lua code. This issue is addressed in version 6.0.13 by disabling Lua unless the allow-rules option is set to true in the Lua security configuration section.

A vulnerability in the sofa-hessian component of Solon before v2.3.3 allows attackers to execute arbitrary code by providing crafted payload.

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

In OpenBSD 7.2 before errata 026 and 7.3 before errata 004, as well as in LibreSSL before 3.6.3 and 3.7.x before 3.7.3, a double free or use after free could occur after SSL_clear.

A buffer overflow vulnerability was discovered in the TP-Link Archer AX10 (EU) router firmware version V1.2_230220, specifically in the function FUN_131e8 - 0x132B4. This could allow an attacker to execute arbitrary code or cause a denial of service.

Versions 3.5.0 and 3.5.1 of jeecg-boot have a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface.

Simple Customer Relationship Management version 1.0 is vulnerable to SQL Injection via the email parameter.

Vulnerability in HwWatchHealth that can be exploited to hijack the application. Successful exploitation may lead to repeated pop-up windows of the app.

A SQL injection vulnerability has been identified in the MOVEit Transfer web application before version 2021.0.8 that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.

PublicCMS versions up to 4.0.202302 are vulnerable to insecure permissions, potentially allowing unauthorized access to resources.