CVE Vulnerability Catalog

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

Grafana has a vulnerability that allows unauthenticated and authenticated users to view snapshots with the lowest database key by accessing specific paths. If the public_mode setting is enabled, unauthenticated users can also delete such snapshots. Authenticated users can delete snapshots regardless of this setting, leading to complete snapshot data loss.

W Apache HTTP Server 2.4.49 znaleziono lukę w normalizacji ścieżek, która umożliwia atak typu path traversal. Atakujący może uzyskać dostęp do plików poza skonfigurowanymi katalogami, co może prowadzić do zdalnego wykonania kodu, jeśli skrypty CGI są włączone dla tych ścieżek.

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

An information disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version: 2.01MT. An attacker can obtain a user name and password by forging a post request to the /getcfg.php page.

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

A vulnerability in Apache HTTP Server allows a remote attacker to redirect requests via mod_proxy to an origin server of their choice using a crafted URI path. Affects versions 2.4.48 and earlier.

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

CVE-2021-40444 is a remote code execution vulnerability in the MSHTML engine of Internet Explorer, exploited via specially crafted Microsoft Office documents. An attacker creates a malicious ActiveX control, and the victim must open the document, leading to code execution.

Elevation of privilege vulnerability in Open Management Infrastructure. Could be exploited to gain elevated privileges.

An elevation of privilege vulnerability in Open Management Infrastructure (OMI).

Remote code execution vulnerability in Open Management Infrastructure (OMI). Allows a remote unauthenticated attacker to execute arbitrary code.

Remote code execution vulnerability in Microsoft Office Access Connectivity Engine. An attacker could exploit it to run malicious code on the victim's system.

Elevation of privilege vulnerability in Open Management Infrastructure. Could be exploited to gain elevated privileges.

Elevation of privilege vulnerability in Windows Common Log File System Driver. Could be exploited to gain elevated privileges.