CVE Vulnerability Catalog

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit it to launch a denial-of-service (DoS) attack.

An allocation of resources without limits or throttling vulnerability affects several QNAP operating system versions. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

A NULL pointer dereference vulnerability affects several QNAP operating system versions. A remote attacker with a user account can exploit it to launch a denial-of-service (DoS) attack.

A vulnerability was found in PluXml up to 5.8.22 in the FileCookieJar::__destruct function of core/admin/medias.php in the Media Management Module. Manipulating the File argument can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and the vendor announced a fix in version 5.8.23.

A vulnerability in REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy in login attempt responses.

A path traversal vulnerability was found in carRental in the downloadShowFile function in /file/downloadShowFile.action. Manipulation of the path argument allows remote attack. The project has not responded to the report.

A vulnerability was found in EmpireSoft EmpireCMS up to 8.0 in the CheckSaveTranFiletype function of the file e/class/connect.php, allowing unrestricted upload. The attack can be launched remotely, and the exploit has been disclosed publicly.

A flaw was found in EmpireSoft EmpireCMS up to 8.0 in the egetip function of the file e/class/connect.php in the IP Address Handler component. Manipulation causes protection mechanism failure. The attack can be initiated remotely, and the exploit has been published.

An unrestricted upload vulnerability was found in wangmarket up to 6.4, in the uploadImage function of the file /sits/uploadImage.do. Manipulating the image argument allows remote exploitation.

A server-side request forgery (SSRF) vulnerability was found in go-sonic up to 1.1.4, in the FetchTheme function of the file service/theme/git_fetcher.go. Manipulating the uri argument allows remote attack.

A vulnerability was detected in wasm3 up to 0.5.0 in the op_SetSlot_i32/op_CallIndirect functions of m3_exec.h. Manipulation leads to memory corruption, and the attack requires local access. The exploit is public and the project currently has no active maintainer.

An out-of-bounds read vulnerability was found in WebAssembly wabt up to 1.0.39, in the function wabt::Decompiler::VarName of the file /src/repro/wabt/bin/wasm-decompile. Local access is required for the attack.

A vulnerability in WebAssembly wabt up to 1.0.39 affects the function wabt::AST::InsertNode in the file /src/repro/wabt/bin/wasm-decompile of the wasm-decompile component. The manipulation causes memory corruption. The attack can be launched on the local host, and the exploit has been made publicly available.

Signal K Server before version 2.19.0 has a vulnerability in the access request system that combines two related issues: improper display of the `permissions` field (less visible than the description) and unconditional trust in the `X-Forwarded-For` header for determining the client's IP address. An attacker can exploit these flaws to craft a convincing social engineering attack against an administrator, impersonating a trusted device and requesting elevated permissions.