CVE Vulnerability Catalog

The Participants Database plugin (participants-database) for WordPress by xnau webdesign contains an SQL Injection vulnerability (improper neutralization of special elements in an SQL command) enabling blind SQL injection. The issue affects versions up to and including 2.7.8.5.

CGM CLININET is vulnerable to local privilege escalation. The service processing incoming HL7 messages runs with root privileges, but due to incorrect permissions its scripts and configuration files can be modified by the uhcapache user, allowing execution of arbitrary code as root.

CGM CLININET is vulnerable to code injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted user-supplied data. An attacker from an adjacent network can supply a crafted query parameter to import an attacker-controlled module, resulting in arbitrary code execution with root privileges.

CGM CLININET is vulnerable to remote code execution caused by deserialization of untrusted data. The server exposes an HTTP-based API used by the administrative module that exchanges data using Java object serialization; an attacker on the same local network can send a crafted serialized object whose deserialization allows arbitrary code execution with root privileges.

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those systems. An attacker on an adjacent network able to send data to these HL7 processes can achieve remote code execution with root privileges.

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request. This may result in unauthorized access to user accounts and full administrative control of the LMS platform.

A firmware verification vulnerability in Creative Sound Blaster Katana allows an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. The lack of effective integrity verification enables installation of unauthorized software.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 performs no capability check when updating a post through one of its front-end form actions. This allows unauthenticated visitors to overwrite arbitrary posts, including those storing field definitions, leading to arbitrary code execution on the server. Exploitation requires a published form whose post-update action maps both target and content to visitor-submitted values.

In Part-DB before version 2.12.1, the attachment upload handler's dangerous-extension blocklist does not include phar. A .phar file uploaded as an attachment is stored in public/media/ (the Apache document root), and the shipped Apache configuration routes .phar to PHP-FPM, allowing execution of arbitrary PHP.

An input validation issue in the Okta Access Gateway (OAG) Admin Console allows processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

An authentication bypass vulnerability in the public onPhase/frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters.

The network management service on Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command. An authenticated web user with network configuration permissions can exploit this to execute arbitrary operating system commands as root.

The system control service on Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for a critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots.

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.