CVE Vulnerability Catalog

A use-after-free vulnerability in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

A stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

A use-after-free vulnerability in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

A deserialization of untrusted data vulnerability in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.

An OS command injection vulnerability in ColdFusion allows arbitrary code execution in the context of the current user. Exploitation requires no user interaction, and the scope is changed.

A protection mechanism failure in Intel Data Center Attestation Primitives (DCAP) may allow information disclosure. An unprivileged software adversary with an unauthenticated user can exploit the vulnerability with low complexity, no user interaction, via network access. The vulnerability impacts integrity (high) and subsequent confidentiality (high), with no direct impact on confidentiality and availability.

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

SeaweedFS before 4.24 has a vulnerability in the FetchAndWriteNeedle RPC that lacks authentication and target validation. An attacker can send requests to arbitrary hosts, including cloud metadata endpoints, and read the responses.

Twenty before 2.15.0 allows a workspace administrator with DATA_MODEL permission to supply an unescaped expression for the TS_VECTOR field, leading to SQL injection and arbitrary PostgreSQL execution as the application user.

Fooocus up to version 2.5.5 is vulnerable to remote code execution due to unsafe use of eval when processing metadata JSON. An attacker with web UI access can execute arbitrary code.

SeaweedFS before 4.24 registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset. Any client with gRPC access can create users and access keys, gaining S3 administrative control.

TypeBot version 3.16.1 stores API tokens in the database as cleartext. An attacker with database read access can extract all tokens and impersonate any user without password or MFA.

SIMULIA Execution Engine from Release 2023 through 2026 has an untrusted data deserialization vulnerability that could lead to unauthenticated remote code execution.

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.

Streambert before 2.5.0 improperly validates executable paths supplied to the run-download IPC handler, allowing a compromised renderer to execute arbitrary local binaries with the app's privileges.

Streambert before 2.5.0 has an unvalidated auto-updater URL vulnerability that allows a compromised renderer to make the main process download and execute an arbitrary binary, resulting in remote code execution.

YesWiki before 4.6.4 has an unauthenticated SQL injection in the Bazar form-import path, allowing any visitor to inject arbitrary SQL into an INSERT statement and read the full database, including password hashes.

Vulnerability in n8n before versions 2.31.5 and 2.32.1 allows a sandbox escape in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.