CVE Vulnerability Catalog

Tenda CX12L router version 16.03.53.12 has a stack-based buffer overflow in the fromP2pListFilter function in /goform/P2pListFilter. An attacker from the local network can manipulate the page argument to trigger the overflow.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The parameter is not validated, allowing redirection to arbitrary external websites.

WeGIA before 3.6.9 has a stored XSS vulnerability via a backup filename. An attacker can inject malicious scripts that execute in the victim's browser.

WeGIA prior to 3.6.9 has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter. The application fails to validate the parameter, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The parameter is not validated, allowing redirection to arbitrary external websites.

Bulwark Webmail prior to version 1.4.11 sets the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means XSS attacks are logged but not blocked, allowing arbitrary JavaScript execution via crafted email HTML.

Lichess.org before commit 0d5002696ae705e1888bf77de107c73de57bb1b3 contains a server-side HTML injection vulnerability. Approved streamers can inject arbitrary HTML into their Twitch/YouTube stream title, which is rendered on the streamer page and the 'Live streams' widget on the homepage.

OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.

In itsourcecode sanitize or validate this input 1.0, the file /borrowedequip.php contains an SQL injection vulnerability via the emp_id parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.

A vulnerability was detected in Totolink A3300R 17.0.0cu.557_B20221024 allowing OS command injection via the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi. The attack can be launched remotely and the exploit is publicly available.

The Discount library, a C implementation of Markdown, has a signed length truncation bug causing an out-of-bounds read. Inputs larger than INT_MAX are truncated to a signed int before parsing, allowing read past the buffer and process crash. Affects versions from 1.3.1.1 to 2.2.7.3.

Vulnerability in Parse Server before versions 8.6.73 and 9.7.1-alpha.4 allowing file upload with a valid extension but mismatched Content-Type header. Some storage adapters (S3, GCS) serve the file with the provided Content-Type, potentially leading to attacks.

Microsoft's SymCrypt cryptographic library has a truncation bug in the SymCryptXmssSign function, where a 64-bit leaf count is passed to a 32-bit parameter. For XMSS^MT with tree height >= 32, this truncates to zero, causing undersized buffer allocation and heap overflow during signature computation. Affects versions from 103.5.0 to 103.10.0.

dye before 1.1.1 allows arbitrary code execution via crafted template expressions. The vulnerability was discovered and fixed by the author.

WWBN AVideo in versions 26.0 and prior contains a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint at admin/playerUpdate.json.php because it does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

WWBN AVideo open source video platform versions 26.0 and earlier have a CSRF vulnerability in the site customization endpoint. It lacks CSRF token validation and writes uploaded logo files before ORM security checks, allowing cross-origin POST to overwrite the logo.

WWBN AVideo up to version 26.0 has a vulnerability in the SocialMediaPublisher plugin where the publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Vulnerability in onHeaderDecoded of LocalImageResolver.java leading to persistent denial of service due to resource exhaustion. Local attack requires no additional privileges or user interaction.

In the importWrappedKey function in KMKeymasterApplet.java, there is a vulnerability that allows access to keys that should be restricted due to improper input validation. This could lead to local information disclosure without the need for additional execution privileges. User interaction is not required for exploitation.

In itsourcecode Construction Management System 1.0, the file /borrowed_tool.php contains an SQL injection vulnerability via the emp parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.