CVE Vulnerability Catalog

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

Denial of service vulnerability in IBM HTTP Server versions 8.5 and 9.0 via the optional module mod_mem_cache.

IBM HTTP Server 8.5 and 9.0 is vulnerable to invalid pointer dereference. A privileged user authenticated to the Administration Server could exploit this to expose sensitive information or cause a denial of service.

IBM HTTP Server 8.5 and 9.0 contain a buffer overflow vulnerability. A privileged user authenticated to the Administration Server could exploit this to execute remote code or cause a denial of service.

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty are vulnerable to HTTP request smuggling. An attacker can send a specially crafted request that is misinterpreted by the server.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability, allowing arbitrary code execution in the context of the current process.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a memory corruption vulnerability. An attacker can leverage this to execute arbitrary code in the current process context.

A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an out-of-bounds write vulnerability. An attacker may leverage this to cause a crash, data corruption, or arbitrary code execution.

FastNetMon Community Edition up to version 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls. An attacker who can influence argv[] values can inject arbitrary shell commands.

FastNetMon Community Edition up to version 1.2.9 has a configuration injection vulnerability in the Juniper router integration plugin. The $IP_ATTACK variable (from argv[1]) is directly interpolated into NETCONF commands without validation, allowing an attacker to inject additional Juniper CLI commands via newline characters. This can lead to modification of routing tables, firewall filters, user accounts, and other configuration elements.

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.7, an organization admin can escalate their privileges by adding a user from a different organization with higher privileges to their own organization. This is due to incorrect ACL on userEdit relationAdd. This vulnerability is fixed in 6.9.7.

Babel, a JavaScript compiler, from version 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, when compiling attacker-crafted code, can generate output that executes arbitrary code.

SQL injection vulnerability in Chatwoot versions 2.2.0 through 4.11.2 in conversation and contact filter APIs. An authenticated attacker can inject arbitrary SQL via date or number filter parameters.

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, it is vulnerable to stored XSS via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who views the affected page. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts.

FACTION prior to 1.8.3 is vulnerable to stored cross-site scripting (XSS) via attachment filenames in remediation verification file preview flows. User-supplied filenames are persisted and rendered into HTML and attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who opens the affected views.

NVIDIA vGPU software has a use-after-free vulnerability in the virtual GPU manager. Successful exploitation may lead to denial of service, privilege escalation, information disclosure, data tampering, and code execution.

NVIDIA Display Driver for Linux has an out-of-bounds read vulnerability. Successful exploitation may lead to denial of service and information disclosure.

NVIDIA Display Driver for Linux has a vulnerability in UVM, where a user can cause improper input validation. Successful exploitation might lead to denial of service.

The NVIDIA Display Driver for Linux has a vulnerability in a kernel mode layer handler, where a user could cause improper permission handling. Successful exploitation might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.

NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution.