CVE Vulnerability Catalog

CVE-2023-6675 vulnerability affects CyberMath, allowing unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.

Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.

Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker can send operating system commands to the device via the web configuration functionality.

A vulnerability in Projectworlds Vistor Management System in PHP version 1.0 allows a remote attacker to escalate privileges via a crafted script sent to the login page in the POST/index.php path.

Podatność CVE-2023-52221 dotyczy nieograniczonego przesyłania plików o niebezpiecznych typach w aplikacji UkrSolution Barcode Scanner i Inventory Manager. Problem ten występuje w wersjach od n/a do 1.5.1.

A vulnerability in Snapcast version 0.27.0 allows remote attackers to execute arbitrary code and obtain sensitive information via a crafted request to the JSON-RPC API.

An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. It allows an attacker to execute arbitrary code by uploading a crafted file.

An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05. Attackers can upload a crafted file, leading to arbitrary code execution on the server.

An issue in YonBIP v3_23.05 from Yonyou allows a remote attacker to execute arbitrary code via a crafted script sent to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.

An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. An attacker can upload a crafted file, leading to arbitrary code execution on the server.

A SQL injection vulnerability was discovered in YonBIP v3_23.05 via the runScript() method of the AttendScriptController. An attacker can exploit this flaw to execute arbitrary SQL queries.

An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script sent to the FrameworkShellController component.

Hard-coded credentials in FOLIO mod-data-export-spring before version 1.5.4 and from 2.0.0 to 2.0.2 allow unauthenticated users to access critical APIs, modify user data, change configurations including single-sign-on, and manipulate fees/fines.

CVE-2024-23679 in Enonic XP versions before 7.7.4 allows a remote unauthenticated attacker to reuse prior sessions due to missing session attribute invalidation.

In the actiNAS SL 2U-8 RDX version 3.2.03-SP1, improper access control was found in the nasSvr.php file. A remote attacker can read and modify different types of data without authentication.

Wtyczka Stripe Payment Plugin dla WooCommerce w WordPressie jest podatna na atak typu SQL Injection poprzez parametr 'id' we wszystkich wersjach do 3.7.9 włącznie, z powodu niewystarczającego zabezpieczenia dostarczonego przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL. Atakujący bez uwierzytelnienia mogą dodawać dodatkowe zapytania SQL do już istniejących, co może prowadzić do wycieku wrażliwych informacji z bazy danych.

CVE-2023-5806 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Mergen Software Quality Management System. This issue affects versions prior to v1.2.

W serwerze X.Org znaleziono lukę, która prowadzi do przepełnienia sterty. Zdarzenia DeviceFocusEvent oraz odpowiedzi XIQueryPointer zawierają bity dla każdego aktualnie wciśniętego przycisku, jednak serwer X.Org alokował miejsce tylko dla określonej liczby przycisków urządzenia.

Wtyczka Social Warfare dla WordPressa jest podatna na zdalne wykonanie kodu w wersjach do 3.5.2 włącznie, poprzez parametr 'swp_url'. Umożliwia to atakującym wykonanie kodu na serwerze.