CVE Vulnerability Catalog

CVE-2023-3374 vulnerability in Unisign Bookreen allows for privilege escalation due to an incomplete list of disallowed inputs. This issue affects Bookreen versions before 3.0.0.

Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter. An attacker can manipulate database queries, potentially leading to unauthorized data access.

A critical vulnerability was found in Tenda AC8 version 16.03.34.06_cn_TDC01 in the formSetDeviceName function, leading to stack-based buffer overflow. The vulnerability can be exploited remotely.

Proscend Advice ICR Series routers FW version 1.76 have a vulnerability related to the use of default credentials, which may lead to unauthorized access.

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.

CVE-2023-40980 in DWSurvey DWSurvey-OSS version 3.2.0 and earlier allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file.

Version 0.0.245 of the LanChain-ai Langchain library contains a vulnerability that allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Integer Overflow vulnerability in mp_grow in libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 allows attackers to execute arbitrary code and cause a denial of service (DoS).

CVE-2023-36327 describes an integer overflow vulnerability in the RELIC library before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allowing attackers to execute arbitrary code and cause a denial of service in the pos argument of the bn_get_prime function.

An Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling the realloc function in the bn_grow function.

CVE-2023-36187 describes a buffer overflow vulnerability in NETGEAR R6400v2 devices before version 1.0.4.118, allowing remote unauthenticated attackers to execute arbitrary code via a crafted URL to httpd.

An issue was discovered in IceCMS version 2.0.1, allowing attackers to escalate privileges and gain sensitive information via the UserID parameter in api/User/ChangeUser.

Version 3.1.9 and earlier of smanga contains an SQL Injection vulnerability that allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php.

In versions of tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.

Improper access control exists in the GitHub repository usememos/memos prior to version 0.13.2.

The Digi RealPort Protocol is vulnerable to a replay attack that may allow an attacker to bypass authentication to access connected equipment.

There is a remote command execution vulnerability due to improper input validation. This affects Acronis Cloud Manager (Windows) before build 6.2.23089.203.

There is a remote command execution vulnerability due to improper input validation. This affects Acronis Cloud Manager (Windows) before build 6.2.23089.203.

An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrary code via uploading a crafted HTML file.

CVE-2023-41636 describes a SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38, allowing attackers to access the database and execute arbitrary commands via a crafted SQL query.