CVE Vulnerability Catalog

Aris version v10.0.23.0.3587512 and earlier does not enforce rate limiting or throttling in its file upload functionality, allowing users to upload files at an unrestricted rate. An attacker can exploit this to rapidly upload a large volume of files, potentially leading to resource exhaustion such as disk space depletion, increased server load, or degraded performance.

In HCL DevOps Deploy versions 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.

Server-Side Request Forgery (SSRF) vulnerability in minnur External Media allows Server Side Request Forgery. This issue affects External Media from n/a through <= 1.0.36.

Kieback&Peter Neutrino-GLT product is used for building management. Its web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02.

Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 has a stored XSS (CWE-79) vulnerability in survey content and administration functionality. Authenticated users with survey creation or edit privileges can execute arbitrary JavaScript in other users' browsers, steal session information, and perform unauthorized actions.

The Plus Addons for Elementor Pro (theplus_elementor_addon) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions through 6.3.7.

Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows path traversal. This issue affects Advanced Database Cleaner PRO from n/a through 3.2.10.

In the Oneline Lite theme (WordPress plugin), there is a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 6.6.

The JetEngine plugin (up to version 3.8.1.1) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.

Transient Denial of Service (DoS) vulnerability while parsing a WLAN management frame with a Vendor Specific Information Element. Can be exploited by a remote attacker to disrupt device operation.

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.

A memory corruption vulnerability occurs while handling sensor utility operations. Improper data processing leads to memory corruption.

Memory corruption while accessing a synchronization object during concurrent operations.

Memory corruption while performing sensor register read operations.

Memory corruption while parsing clock configuration data for a specific hardware type.

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Memory corruption while handling buffer mapping operations in the cryptographic driver.

A memory corruption vulnerability occurs while processing a config call from userspace. Improper handling of input data leads to memory corruption.

Information disclosure while processing a firmware event.

A transient denial of service (DOS) vulnerability occurs while parsing video packets received from the video firmware. Improper packet processing leads to temporary service unavailability.