CVE Vulnerability Catalog

A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafted HTML file to the interface /auth_pic.cgi.

An issue was discovered in Progress DataDirect Connect for ODBC before version 08.02.2770 for Oracle. When using Oracle Advanced Security (OAS) encryption, if an error occurs while initializing the encryption object, the code falls back to a different encryption mechanism that uses an insecure random number generator to generate the private key.

A critical vulnerability has been found in SourceCodester Lost and Found Information System version 1.0, affecting an unknown functionality of the file admin\inquiries\view_inquiry.php. Manipulation of this functionality leads to SQL injection.

A critical vulnerability was found in the Lost and Found Information System version 1.0, allowing SQL injection through manipulation of the id argument in the admin\user\manage_user.php file.

The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templates function in versions up to and including 4.0.6. This allows subscriber-level attackers to obtain plugin template information; the nonce check is skipped when no nonce is provided.

JavaCPP Presets uses the `github.event.head_commit.message` parameter insecurely, leading to a command injection vulnerability. This issue has been addressed in version 1.5.9.

CVE-2023-34243 affects the TGstation toolset that manages BYOND servers. In affected versions, an attacker could discover a Windows username by brute-forcing the login endpoint with an invalid password.

Versions of Chamilo v1.11.x up to v1.11.18 were found to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.

Versions of Chamilo from v1.11.* up to v1.11.18 have a vulnerability that allows attackers to perform a Server-Side Request Forgery (SSRF). This can lead to obtaining information about services running on the server through crafted requests in the social and links tools.

Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download documents belonging to another student if they know the document's ID.

Thruk versions 3.06 and prior are vulnerable to a Path Traversal attack in the `panorama.pm` file, allowing an attacker to upload files to any folder with write permissions. The location parameter is not filtered or validated.

A stack overflow was discovered in the Tenda AC10 v4 device related to the shareSpeed parameter at the /goform/WifiGuestSet endpoint.

The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow vulnerability via the devName parameter at the /goform/SetOnlineDevName endpoint.

A stack overflow was discovered in the Tenda AC10 v4 device via parameter list at the /goform/SetNetControlList endpoint.

A stack overflow was discovered in the Tenda AC10 v4 related to the 'time' parameter at the /goform/PowerSaveSet endpoint.

The Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn device was found to contain a stack overflow via parameter list at the endpoint /goform/SetVirtualServerCfg.

D-Bus before 1.15.6 allows unprivileged users to crash dbus-daemon. If a privileged user is monitoring message bus traffic, an unprivileged user can cause a dbus-daemon crash by sending an unreplyable message.

IBM TXSeries for Multiplatforms and CICS TX Standard and Advanced are vulnerable to cross-site scripting (XSS). This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contains a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, which may lead to file exposure when running the development server.

IBM TXSeries for Multiplatforms versions 8.1, 8.2, 9.1, and CICS TX Standard and Advanced versions 10.1, 11.1 may allow a privileged user to obtain highly sensitive information by enabling debug mode.