CVE Vulnerability Catalog

axTLS v2.1.5 was discovered to contain a heap buffer overflow in the bi_import function in axtls-code/crypto/bigint.c. This vulnerability allows attackers to cause a Denial of Service (DoS) when parsing a private key.

In the TP-Link TAPO C200 V3 (EU) camera with firmware 1.1.22 Build 220725, the AES Key-IV pair is shared across all devices. An attacker with physical access to the camera can extract and decrypt sensitive data, including the WiFi password and TP-Link account credentials of the victim.

There is a memory leak in version 2.1.0 of the yajl library related to the use of the yajl_tree_parse function. This can lead to out-of-memory conditions on the server and ultimately cause crashes.

A critical vulnerability was found in SourceCodester Service Provider Management System 1.0, affecting an unknown part of the file view_service.php. Manipulation of the argument id leads to SQL injection.

A critical vulnerability has been found in SourceCodester Service Provider Management System version 1.0. Manipulation of the 'id' argument in the view.php file leads to SQL injection, which can be exploited remotely.

Minical version 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php.

Minical version 1.0.0 is vulnerable to Cross Site Scripting (XSS) due to insufficient input validation in the application's user input handling in the security_helper.php file.

In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.

Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.

Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.

Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.

Tamale RMS version < 23.1 from Advent/SSC Inc. is vulnerable to Directory Traversal. An attacker can access contact information, including usernames, email addresses, and other internal data stored within the web app.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository admidio/admidio prior to version 4.2.8, allowing for the storage of malicious code.

A buffer overflow in EasyPlayerPro-Win versions from 3.2.19.0106 to 3.6.19.0823 allows attackers to cause a Denial of Service (DoS) via a crafted XML file.

SonicJS up to v0.7.0 allows attackers to execute an authenticated path traversal when an attacker injects special characters into the filename of a backup CMS.

Versions 11 and later of emoncms have an information disclosure vulnerability that allows attackers to obtain the web directory path and other information leaked by the server via a crafted web request.

The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

A critical vulnerability has been found in IBOS version 4.5.5, affecting the actionDel function in the file ?r=dashboard/approval/del. Manipulation of the argument id leads to SQL injection.

A critical vulnerability was found in KylinSoft youker-assistant on KylinOS in the delete_file function in the dbus.SystemBus library of the Arbitrary File Handler component. Manipulation of this function leads to improper access controls.

A critical vulnerability has been found in KylinSoft youker-assistant on KylinOS in the function restore_all_sound_file, leading to path traversal: '../filedir'. Local exploitation is required.