CVE Vulnerability Catalog

A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. The vulnerability affects the Upload function in application/lib/file/LocalUploader.php of the File Upload Handler component. Manipulation of the File argument can lead to code injection. The attack can be executed remotely, and the exploit has been published.

A vulnerability was detected in ZKTeco BioTime up to versions 9.0.3/9.0.4/9.5.2, affecting an unknown part of the file /base/safe_setting/ of the Endpoint component. Manipulating the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials.

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the Member Endpoint component. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

A vulnerability in XCMS (up to 3fab5342cc509945a7ce1b8ec39d19f701b89261) affects the Upload function in Admin/Home/Controller/ProductImageController.class.php of the Backend component. Manipulation of the File argument leads to unrestricted upload. The attack can be launched remotely, and the exploit has been publicly disclosed.

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, and 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

A weakness in getmaxun maxun (up to 0.0.28) affects the router.get function in server/src/routes/auth.ts of the Authentication Endpoint component. Manipulation can lead to improper authorization. The attack can be executed remotely, and the exploit has been made public.

LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.

FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, an attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on a given instance, making it unusable for the majority of users. This issue has been patched in version 1.28.0.

Yealink T21P_E2 Phone version 52.84.0.15 is vulnerable to directory traversal. A remote attacker with normal privileges can read arbitrary files via a crafted request to the diagnostic component's result read function.

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.

The web management interface in ETL Systems Ltd DEXTRA Series Digital L-Band Distribution System v1.8 does not implement CSRF protection mechanisms on critical configuration endpoints.

A vulnerability in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter video rendering function.

A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.

SQL injection vulnerability in SMS v.1.0 (krishanmuraiji) in /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.

An issue was discovered in Delight Custom Firmware for Nokia Symbian Belle devices allowing local attackers to inject startup scripts via crafted .txt files in the :\Data directory.

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

IBM System Storage DS8000 in versions DS8A00 R10.1, DS8A00 R10.0, and DS8900F R9.4 may allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of server-side security mechanisms.

IBM Concert versions 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.