CVE Vulnerability Catalog

Vulnerability in NVIDIA Transformers4Rec for Linux allows improper deserialization of untrusted data. Successful exploitation may lead to code execution, data tampering, and information disclosure.

FastNetMon Community Edition up to 1.2.9 exposes an unauthenticated gRPC API on port 50052. An attacker with network access can ban IPs, unban attacks, and execute external scripts.

FastNetMon Community Edition up to version 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The decode_mp_reach_ipv6() function does not validate data before use, allowing an attacker to control field lengths and trigger out-of-bounds reads.

In e107 before 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to generate password reset links pointing to attacker-controlled domains.

The deployment of Genetec RabbitMQ has a high-severity vulnerability that allows a privilege escalation attack.

A security flaw has been discovered in Das Parking Management System 6.2.0. This vulnerability affects unknown code of the component Search API Endpoint. The manipulation of the argument Value results in SQL injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.

A SQL injection vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0 in the xp_cmdshell function of the ParkingRecord/ExportParkingRecords file within the API endpoint. Manipulation of the Value argument allows remote attack execution. The exploit is publicly available and may be used.

A path traversal vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 allows remote manipulation of the path argument in /SubstationWEBV2/app/..;/main/upfile, leading to arbitrary file read. Exploit is publicly available.

Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.

In Karakeep before 0.32.0, an SSRF protection bypass was identified via crafted HTTP redirects. An authenticated user can initiate requests to internal Docker services.

OpenKM version 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

Vulnerability in gix-submodule (before 0.29.0), gitoxide (before 0.5.21), and gix (before 0.84.0) allows bypassing the CommandForbiddenInModulesConfiguration guard. An attacker can inject arbitrary shell commands via the update field in .gitmodules, executed when Submodule::update() is called on a previously initialized submodule.

In FreeRDP before version 3.26.0, a heap-buffer-overflow vulnerability in gdi_CacheToSurface allows remote attackers to write out-of-bounds heap memory. Rectangle validation clamps coordinates to UINT16_MAX but copy operations use unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

Shenzhen Sixun Shanghui Group Business Management System version 10 has an SQL injection vulnerability in the /api/Dinner/PayConfig file via the tableno parameter. The attack can be performed remotely and the exploit is publicly available.

When the Identity Awareness blade is enabled with Browser-Based Authentication on the Security Gateway, an unauthenticated user may be able to read certain internal files on the gateway.

The Security Gateway incorrectly validates a length value in IKE packets when NAT-T is used (port 4500/UDP). A specially crafted packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service.

The VPN service mishandles an unexpected IKE fragment value on port 500/UDP during early connection setup, causing the service to terminate unexpectedly and temporarily disrupting VPN functionality.

An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by an unauthenticated network-based attacker to permanently prevent legitimate users from interacting with the service.

A PHP Remote File Inclusion vulnerability in Magentech SW Core (versions up to 1.7.18) allows PHP Local File Inclusion due to improper control of filename in include/require statements.