CVE Vulnerability Catalog

An observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack before 5.03.01.54.

User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.

A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Student Result Management System 1.0 in the Announcement Module, in the file script/academic/core/new_announcement.php, affecting the title/announcement arguments. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.

The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift C++ bindings (versions before 0.25.0) contain a missing release of memory after effective lifetime vulnerability. This can lead to gradual memory resource exhaustion.

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift PHP bindings (versions before 0.25.0) contain an allocation of resources without limits or throttling vulnerability. This can lead to server resource exhaustion.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift C++ WebSocket server (versions before 0.25.0) contains a use of uninitialized resource and return of wrong status code vulnerability. This can lead to unpredictable application behavior.

Uncaught exception, improper handling of exceptional conditions, and improper resource shutdown in Apache Thrift D TNonblockingServer. Affects versions before 0.25.0.

NULL pointer dereference vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.