CVE Vulnerability Catalog

A vulnerability was identified in FAST FAC1900R version 20190827_2.0.2.2 in the copy_msg_element function of the devdiscover Service component. Manipulation leads to a stack-based buffer overflow, and the attack can be executed remotely. The exploit is publicly available and may be used; the vendor did not respond to the disclosure.

A vulnerability was determined in FAST FAC1200R version 5.0_20201119_1.0.2 in the MmtAtePrase function of the MmtAtePrase Parser component. Manipulation causes a stack-based buffer overflow, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.

LDAPCache and LDAPBackingEngine build LDAP search filters by substituting %u, %dn, and %fqdn into administrator-configured filter templates (userFilter, roleFilter) without full RFC 4515 escaping. Before the fix, only double backslashing was applied, which does not escape *, (, ), and NUL. A login name containing these characters can alter the filter structure, e.g. turning an equality match into a wildcard match or closing/reopening filter clauses.

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'vendor_store_name' in the endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

A vulnerability was found in FAST FAC1200R version 5.0_20201119_1.0.2 in the parse_advertisement_frame function of the devdiscover Service component. Manipulation results in a stack-based buffer overflow, and the attack may be launched remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

A vulnerability in FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1 affects the path.join function in /src/main/core/createParsedTrack.ts. Manipulation leads to path traversal. The attack must be carried out locally, and the exploit has been publicly disclosed.

A flaw in UERANSIM up to 3.3.0 affects the DecodePlainMmMessage function in the library src/lib/nas/encode.cpp of the nr-gnb component. Executing a manipulation leads to an uncaught exception. The attack can be launched remotely, and the exploit has been published.

A vulnerability in XunruiCMS up to 4.7.2 affects the group_all_edit function in dayrui/App/Member/Controllers/Admin/Home.php of the Group Editing component. Manipulation of the groupid argument causes SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.

A denial of service via unsigned underflow in libXpm's write path before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

An out-of-bounds read exists in libXtst's RECORD reply parser in versions before 1.2.6. A malicious X server could exploit this to crash attached X clients.

An out-of-bounds read in libX11's byte-oriented codeset parser before 1.8.14 could be used by malicious X servers to crash attached X clients.

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser before 1.8.14 could be used by malicious X servers to crash attached X clients.

An out-of-bounds read vulnerability in libX11's XIM attribute parser before 1.8.14 could be used by malicious X servers to crash attached X clients.

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion before 1.8.4 could be used by malicious X server to crash an attached X client.

BUFFALO Wi-Fi products improperly handle web form input when assembling internal command line strings. An administrative user can send a crafted HTTP request to execute an arbitrary OS command.

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comments on at least one weblog and whose moderator subsequently reviews the submitted comment; no non-default server setting is required.

An unrestricted upload of a file with a dangerous type vulnerability exists in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System, allowing upload of a web shell to a web server. This affects versions from 6.7.141 before 10.0.11.