CVE Vulnerability Catalog

A local buffer overflow vulnerability exists in 10-Strike Network Scanner 3.0 in the host name field, allowing attackers to bypass SafeSEH protections and execute arbitrary code. Malicious payloads in the host name or address field trigger the flaw via Trace route or System information functions.

10-Strike Network Inventory Explorer 8.54 contains a stack-based buffer overflow vulnerability in the registration key input field that allows local attackers to execute arbitrary code by triggering a structured exception handler overwrite. Attackers can craft a malicious registration key string with 4188 bytes of padding followed by SEH chain values and shellcode, then paste it into the registration dialog to achieve code execution with application privileges.

Smartshop 1 contains a time-based blind SQL injection vulnerability allowing unauthenticated attackers to manipulate database queries via the 'searched' parameter in search.php. Attackers can send GET requests with SQL payloads like SLEEP to extract sensitive data.

Smartshop 1 contains a SQL injection vulnerability allowing unauthenticated attackers to execute arbitrary SQL queries via the id parameter in product.php. Attackers can send GET requests with union-based SQL payloads to extract sensitive data like usernames and database names.

Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to category.php with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames.

In the Linux kernel, during skb coalescing in skb_try_coalesce(), the SKBFL_SHARED_FRAG marker is not propagated, breaking an invariant for later in-place writers. This can cause ESP processing errors where data is decrypted in place over page-cache backed frags.

A vulnerability was found in the Linux kernel's network packet fragment transfer helpers. Functions __pskb_copy_fclone() and skb_shift() fail to propagate the SKBFL_SHARED_FRAG flag, causing the destination socket buffer to not report shared pages. This can lead to writing into the page cache of read-only files by an unprivileged user.

A buffer overflow vulnerability was found in Edimax BR-6428NS version 1.10 in the formWirelessTbl function of /goform/formWirelessTbl. Manipulation of the vapurl argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.

A buffer overflow vulnerability was found in Edimax BR-6428NS version 1.10 in the formWanTcpipSetup function of /goform/formWanTcpipSetup. Manipulation of the pppUserName argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.

The WooCommerce PayPal Payments plugin for WordPress up to version 4.0.1 allows unauthenticated attackers to manipulate orders and leak information due to missing authorization on AJAX endpoints ppc-create-order and ppc-get-order. Attackers can create PayPal orders for any WC order and read other users' PayPal order details.

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'WishListMember3_Hooks::generate_api_key' function in all versions up to and including 3.30.1. Authenticated attackers with Subscriber-level access or above can update the REST API Secret Key, which can be used to create a new membership level with the administrator WordPress role and register an arbitrary administrator-level user account, resulting in complete site takeover.

The Wishlist Member plugin for WordPress up to version 3.30.1 lacks proper capability checks in the 'WishListMember\Features\Team_Accounts::save_settings' function. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin options, including the REST API Secret Key.

The WishList Member plugin for WordPress up to version 3.30.1 is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation. The export_settings function lacks capability checks and returns the REST API Secret Key. An attacker can use it to authenticate to the API, create a new membership level with administrator role, and register an admin account, resulting in complete site takeover.

The WishList Member plugin for WordPress up to version 3.30.1 has a privilege escalation vulnerability due to missing authorization in the ajax_get_screen() function. An authenticated attacker with Subscriber-level access can supply an admin screen identifier, causing the plugin to load the API configuration template and return the REST API Secret Key in the AJAX response.

Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network.

Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.

NukeViet CMS versions 4.5.07 and prior contain a Stored XSS vulnerability due to insufficient server-side input sanitization in the Request class. An attacker can inject malicious payloads stored server-side and executed in any user's browser, exploitable by anonymous visitors without authentication.

RT is a ticket tracking system where versions up to 5.0.9 and 6.0.0-6.0.2 contain an authentication bypass vulnerability in LDAP/AD setups. An attacker can authenticate as any LDAP-backed user without valid credentials.