CVE Vulnerability Catalog

A NULL pointer dereference vulnerability has been reported to affect File Station 5. A remote attacker who gains a user account can exploit the vulnerability to launch a denial-of-service (DoS) attack. The vulnerability has been fixed in File Station 5 5.5.6.5018 and later.

A NULL pointer dereference vulnerability has been reported to affect File Station 5. A remote attacker who gains a user account can exploit the vulnerability to launch a denial-of-service (DoS) attack. The vulnerability has been fixed in File Station 5 5.5.6.5018 and later.

A NULL pointer dereference vulnerability has been reported to affect several product versions. A remote attacker who gains a user account can exploit the vulnerability to launch a denial-of-service (DoS) attack. The vulnerability has been fixed in File Station 5 5.5.6.5018 and later.

A SQL injection vulnerability was determined in DedeBIZ up to 6.3.2 in an unknown functionality of /admin/spec_add.php. Manipulation of the flags[] argument causes SQL injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in DedeBIZ up to version 6.3.2 in the file /admin/freelist_main.php. Manipulation of the orderby argument allows injection of malicious SQL code. The exploit has been publicly disclosed and can be used remotely.

A SQL injection vulnerability was found in DedeBIZ up to version 6.3.2 in the file /admin/templets_one_edit.php. Manipulation of the ids argument leads to SQL injection. The exploit has been publicly disclosed and can be used remotely.

A security vulnerability was detected in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/roombook.php. Manipulating the rid argument enables remote attacks. The exploit has been disclosed publicly and may be used.

A weakness was identified in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/reservation.php. Manipulating the email argument enables remote attacks. The exploit has been made available to the public and could be exploited.

A security flaw was discovered in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/newsletterdel.php. Manipulating the eid argument enables remote attacks. The exploit has been released to the public and may be exploited.

A SQL Injection vulnerability was determined in SourceCodester Best House Rental Management System 1.0 in the delete_house function of /admin_class.php via manipulation of the ID argument. The attack can be performed remotely and a public exploit is available.

The BUFFALO Wi-Fi router 'WSR-1800AX4 series' uses a password hash with insufficient computational effort. When WPS is enabled, an attacker may obtain the PIN code and/or Wi-Fi password.

Kod curl do zarządzania połączeniami SSH podczas korzystania z backendu wolfSSH zawierał błędy i nie implementował mechanizmów weryfikacji hosta. To uniemożliwia curlowi wykrywanie ataków typu MITM oraz innych zagrożeń.

The Page & Post Notes plugin for WordPress (all versions up to and including 1.3.4) lacks a capability check in the yydev_notes_save_dashboard_data function. An authenticated attacker with Subscriber-level access or above can modify notes.

The WP Airbnb Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 4.2 due to insufficient URL validation that allows users to pull in a malicious HTML file. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5, and 2.2.0. A workaround is to set up an admission controller to control access to pods/attach resources.

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. Authenticated attackers with Subscriber-level access and above can delete arbitrary user accounts, including administrators, by supplying an arbitrary user_id parameter to wp_delete_user().

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.

A flaw was found in Red Hat Single Sign-On, which is an Open Redirect vulnerability during the logout process. The redirect_uri parameter associated with the openid-connect logout protocol does not properly validate the provided URL.

The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker could then gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings.

Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. (Chromium security severity: Low)