CVE Vulnerability Catalog

Vulnerability in the IDE component of Application Server, which when exploited by an authenticated attacker with 'aaConfigTools' privilege, can allow tampering with App Objects' help files and persist a cross-site scripting (XSS) injection. The attack can lead to horizontal or vertical privilege escalation when executed by a victim.

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documentation portal.

The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit this interface to manipulate robot control functions, including initiating or halting runners, assigning jobs, clearing stations, and deploying storage totes.

A vulnerability in Intelbras ICIP 2.0.20 affects an unknown function in the file /xml/sistema/acessodeusuario.xml. Manipulating the NomeUsuario/SenhaAcess arguments leads to unprotected storage of credentials. The attack can be launched remotely, and the exploit has been publicly disclosed.

An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter, allowing a remote authenticated attacker to execute arbitrary SQL commands by injecting a malicious payload that is concatenated into a raw SQL query in the vucc_qso_details function.

A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.

A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.

A security flaw was discovered in Bdtask/CodeCanyon News365 up to 7.0.3 in /admin/dashboard/profile. Manipulation of the profile_image/banner_image arguments results in unrestricted upload. The attack can be launched remotely, and the exploit has been released to the public.

A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an undersized output buffer. The driver incorrectly assumes the output buffer size matches the input buffer size, leading to invalid memory operations and heap corruption.

A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Serwer Alteryx w wersjach 2022.1.1.42654 i 2024.1 nie weryfikował uprawnień użytkowników do dostępu do określonych identyfikatorów obiektów MongoDB podczas przetwarzania żądań API. Umożliwia to atakującym uzyskanie dostępu do rekordów innych użytkowników, w tym kluczy API administracyjnych i prywatnych kluczy API studia.

A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. The manipulation results in cross-site request forgery (CSRF). The attack can be executed remotely and the exploit is publicly available.

A vulnerability has been identified in rachelos WeRSS we-mp-rss (up to 1.4.7) in the do_job function of jobs/mps.py in the Webhook Module. Manipulation of the web_hook_url argument leads to Server-Side Request Forgery. The exploit is publicly available.

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.

A reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.

SVX Portal 2.7A has a SQL injection (SQL-i) vulnerability via a crafted POST request to admin/update_setings.php.

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows technical information to be disclosed through stack traces.

An Incorrect Access Control vulnerability in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 allows remote access to content without proper permissions due to a Broken Authorization Schema.

A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2. It allows an attacker to hijack a user's browser and capture sensitive information.

A vulnerability was found in the Application Server of Desktop Alert PingAlert versions 6.1.0.11 to 6.1.1.2 involving a Broken or Risky Cryptographic Algorithm. This may weaken the protection of data transmitted or stored by the system.