CVE Vulnerability Catalog

XWiki Platform is vulnerable to a CSRF attack in the create action, allowing remote code execution by users with appropriate permissions. If a user with script rights sees a specific log message, the XWiki installation is at risk.

A stack-based buffer overflow exists in Juplink RX4-1500, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root.

XWiki Platform allows registered users to execute arbitrary scripts in the content field of their profile page, leading to rights escalation. This issue has been present since version 4.3M2 when support for the content field was added in the AppWithinMinutes application.

XWiki Platform has a stored XSS vulnerability that can be exploited by registered users by setting a malicious payload in the time zone user preference. Although the time zone is selected from a dropdown, it can still be set using JavaScript or the appropriate URL.

A vulnerability in the Silicon Labs Gecko Bootloader on ARM allows code injection and authentication bypass due to a buffer overflow and out-of-bounds write issue. This affects both 'Standalone' and 'Application' versions of the bootloader.

The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This allows unauthenticated attackers to specify their user role by supplying the 'role' parameter during registration.

Version 0.0.171 of the langchain library contains a vulnerability that allows a remote attacker to execute arbitrary code via a JSON file used in load_prompt. This issue is related to __subclasses__ or a template.

A stack overflow vulnerability exists in ash.c:6030 in busybox before version 1.35. In the Internet of Vehicles environment, it can be exploited from command execution to arbitrary code execution.

Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.

Version 0.8.0 and earlier of the pandasai library by Gaberiele Venturi contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.

Buffer Overflow vulnerability in JerryScript Project version 3.0.0 allows a remote attacker to execute arbitrary code via the scanner_is_context_needed component in js-scanner-until.c.

An issue was discovered in the kdmserver service on LeEco LeTV X43 version V2401RCN02C080080B04121S, allowing attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).

CVE-2023-39939 describes an SQL injection vulnerability in LuxCal Web Calendar prior to version 5.2.3M (MySQL version) and prior to version 5.2.3L (SQLite version). This allows a remote unauthenticated attacker to execute arbitrary queries against the database, potentially obtaining or altering information.

TP-Link TL-WR941ND V6 devices were found to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm.

D-Link DAP-2660 version 1.13 was found to have a buffer overflow vulnerability via the f_ipv6_enable parameter at /bsc_ipv6. This vulnerability can be exploited by sending a crafted POST request.

Version 1.13 of the D-Link DAP-2660 contains a buffer overflow vulnerability in the /adv_resource component. This vulnerability can be exploited via a crafted GET request.

Models TP-Link WR841N V8, TL-WR940N V2, and TL-WR941ND V5 were found to contain a buffer overflow via the radiusSecret parameter at /userRpm/WlanSecurityRpm.

The TOTOLINK X5000R B20210419 device was found to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.

TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were found to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.