CVE Vulnerability Catalog

Memory corruption occurs when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Transient denial of service occurs when processing a continuous receive command with a zero-sized global configuration override.

Memory corruption occurs when processing draw objects of incorrect type during graphics command list execution.

Memory corruption occurs when accessing and modifying geographic mapping data concurrently without proper synchronization.

A cryptographic issue occurs when processing non-ELF partitions, where authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

Memory corruption occurs when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

A memory corruption vulnerability occurs when the non-secure loader rewrites page tables before secure memory initialization. This can corrupt memory structures used by security mechanisms.

A SQL Injection vulnerability was found in the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL project in the file /admin_transaction.php, caused by manipulation of the Username argument. The attack can be performed remotely, and a public exploit is already available.

The ACPT (Premium) plugin for WordPress in versions up to and including 2.0.66 is vulnerable to Remote Code Execution via the render function. Missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates allow authenticated attackers with subscriber-level access and above to execute code on the server.

The Post SMTP plugin for WordPress in versions up to and including 4.0.1 is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user visits them.

The Sitemovr plugin in versions up to and including 1.0.1 allows an unauthenticated attacker to access sensitive data. No further technical details are provided in the description.

The WP Migration Plugin DB & Files – WP Synchro in versions up to and including 1.16.1 contains a subscriber bypass vulnerability. Technical details are not provided in the description.

The Fluent Affiliate Pro plugin in versions up to and including 1.6.4 is vulnerable to unauthenticated broken access control. Technical details are not provided in the description.

The Real 3D FlipBook plugin in versions up to and including 5.5 is vulnerable to unauthenticated Cross Site Scripting (XSS). Technical details are not provided in the description.

Missing authorization vulnerability in the Morning for WooCommerce (Green Invoice) plugin, versions up to 2.4.1. Allows exploiting incorrectly configured access control security levels.

The FluentBooking Pro plugin in versions below 2.5.0 is vulnerable to unauthenticated broken access control. Technical details are not provided in the description.

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the Auth Guard component. Manipulation of the user_id argument leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the Mobile Binding component. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the System API component. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded.

There is an arbitrary file download vulnerability in the vCast APK delivery mechanism in ViewSonic ViewBoard. A remote, unauthenticated attacker can trigger unprivileged APK installation by serving a malicious APK URL through an unauthenticated download endpoint.