CVE Vulnerability Catalog

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

A Use-After-Free vulnerability in Arm Ltd Bifrost and Valhall GPU kernel drivers allows a local non-privileged user to perform improper GPU memory operations and access already freed memory. Affects versions from r34p0 through r40p0.

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. This could lead to execution of malicious JavaScript in the victim's browser.

SolarWinds Serv-U był podatny na lukę typu traversal katalogu, która umożliwiała dostęp do odczytu wrażliwych plików na maszynie hosta.

An unspecified SQL Injection vulnerability in the Core server of Ivanti EPM 2022 SU5 and earlier allows an unauthenticated attacker within the same network to execute arbitrary code.

Rejetto HTTP File Server up to version 2.3m is vulnerable to template injection. A remote, unauthenticated attacker can execute arbitrary commands on the system by sending a specially crafted HTTP request. Version 2.3m is no longer supported.

In Progress Telerik Report Server version 2024 Q1 (10.0.24.305) or earlier on IIS, an authentication bypass vulnerability exists. An unauthenticated attacker can gain access to restricted functionality.

A vulnerability in Check Point Security Gateways that may allow an attacker to read certain information when the gateway is connected to the internet and has Remote Access VPN or Mobile Access Software Blades enabled. A security fix is available.

In Google Chrome prior to 125.0.6422.112, a type confusion vulnerability exists in V8. A remote attacker can execute arbitrary code inside a sandbox via a crafted HTML page.

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected Authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute unauthorized PowerShell commands.

In Google Chrome prior to 125.0.6422.60, a type confusion vulnerability exists in V8. A remote attacker can execute arbitrary code inside a sandbox via a crafted HTML page.

A vulnerability in the Windows DWM Core Library allows elevation of privilege. Technical details are not disclosed in the description.

A vulnerability in the Windows MSHTML platform allows a security feature bypass. Technical details are not disclosed in the description.

An out-of-bounds write vulnerability in V8 in Google Chrome prior to 124.0.6367.207 allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. (Chromium security severity: High)

In Google Chrome prior to 124.0.6367.201, a use-after-free vulnerability exists in Visuals. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.

In Apache OFBiz before 18.12.13, a path traversal vulnerability exists due to improper limitation of a pathname to a restricted directory. Attackers can access files outside the intended directory.

TP-Link TL-WR841N routers have an improper authentication vulnerability in the httpd service, which listens on TCP port 80 by default. This allows network-adjacent attackers to disclose sensitive information, including stored credentials, without authentication.

A vulnerability in a legacy capability for preloading VPN clients and plug-ins in Cisco ASA and FTD Software allows an authenticated, local attacker with administrator privileges to execute arbitrary code with root-level privileges. The issue is due to improper validation of a file read from system flash memory. A successful exploit could allow code execution after the next reload, potentially altering system behavior.

A vulnerability in the management and VPN web servers of Cisco ASA and FTD Software allows an unauthenticated, remote attacker to cause an unexpected reload, resulting in DoS. The issue is due to incomplete error checking when parsing an HTTP header. A successful exploit could cause a DoS condition when the device reloads.

Wszystkie wersje CrushFTP przed 10.7.1 i 11.1.0 zawierają podatność na wstrzykiwanie szablonów po stronie serwera, która pozwala nieautoryzowanym atakującym zdalnym na odczyt plików z systemu plików poza piaskownicą VFS, obejście uwierzytelnienia w celu uzyskania dostępu administracyjnego oraz wykonanie zdalnego kodu na serwerze.