CVE Vulnerability Catalog

In the Versa Director GUI, the 'Change Favicon' option allows a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to upload a malicious file with a .png extension masquerading as an image. This requires prior authentication.

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office versions from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document.

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.

Nieprawidłowa implementacja algorytmu uwierzytelniania w Ivanti vTM, z wyjątkiem wersji 22.2R1 lub 22.7R2, umożliwia zdalnemu, nieautoryzowanemu atakującemu ominięcie uwierzytelnienia panelu administracyjnego.

A security feature bypass vulnerability exists in Windows Mark of the Web. It could allow execution of untrusted files without warnings.

A vulnerability in the Windows Ancillary Function Driver for WinSock allows for elevation of privilege on Windows systems. The NVD description does not provide technical details or required user interaction.

A vulnerability in Microsoft Project allows for remote code execution. The NVD description does not provide technical details or attack vectors.

A vulnerability in the Scripting Engine involves memory corruption. The NVD description does not provide technical details or attack vectors.

A vulnerability in the Windows Power Dependency Coordinator allows for elevation of privilege on Windows systems. The NVD description does not provide technical details or required user interaction.

A vulnerability in the Windows Kernel allows for elevation of privilege. The NVD description does not provide technical details or required user interaction.

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process.

A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface in Zimbra Collaboration (ZCS) 9.0 and 10.0. An attacker can send an email with a crafted calendar header containing an XSS payload, which executes in the victim's session.

ThreatSonar Anti-Ransomware od TeamT5 nieprawidłowo weryfikuje zawartość przesyłanych plików. Zdalni atakujący z uprawnieniami administratora na platformie produktu mogą przesyłać złośliwe pliki, które mogą być wykorzystane do wykonania dowolnych poleceń systemowych na serwerze.

W podatności CVE-2024-7399 w serwerze Samsung MagicINFO 9 w wersjach przed 21.1050 występuje niewłaściwe ograniczenie ścieżki do zastrzeżonego katalogu, co pozwala atakującym na zapis dowolnych plików z uprawnieniami systemowymi.

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Remote command execution due to use of default passwords in Acronis Cyber Infrastructure. Affects versions before builds 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132.