CVE Vulnerability Catalog

Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before version 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.

The TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in the setStaticDhcpConfig function in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.

TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.

Improper input validation in Zoom Desktop Client for Windows before version 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.

A vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

A vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution. An attacker can exploit this flaw to take control of the system.

Path traversal in Zoom Desktop Client for Windows before version 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.

A vulnerability in Microsoft Message Queuing (MSMQ) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

In SES versions 0.18.0 to 0.18.7, 0.17.0 to 0.17.1, 0.16.0 to 0.16.1, 0.15.0 to 0.15.24, 0.14.0 to 0.14.5, and 0.13.0 to 0.13.5, there is a vulnerability in the confinement of guest applications that may lead to information exfiltration or arbitrary code execution. This vulnerability can be exploited by programs running in Compartments that gain access to the host's dynamic import.

The a2 License Portal System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 1.48.

The a2 Camera Trap Tracking System before version 3.1905 has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands.

CVE-2023-3651 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Digital Ant E-Commerce Software.

CVE-2023-3716 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Oduyo Online Collection Software.

A SQL injection vulnerability was discovered in Judging Management System v1.0 via the id parameter in /php-jms/deductScores.php.

Advantech EKI-1524, EKI-1522, and EKI-1521 devices up to version 1.21 are affected by a Stored Cross-Site Scripting vulnerability that can be triggered by authenticated users in the ping tool of the web interface.

Advantech EKI-1524, EKI-1522, and EKI-1521 devices up to version 1.21 are affected by a Stored Cross-Site Scripting vulnerability that can be triggered by authenticated users in the device name field of the web interface.

CVE-2023-3717 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Farmakom Remote Administration Console. This issue affects versions of the console before 1.02.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4) that is vulnerable to SQL injection. This could allow unauthenticated remote attackers to execute arbitrary SQL queries on the server database.

CVE-2023-3898 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in mAyaNet E-Commerce Software versions before 1.1.

In PHOENIX CONTACT's WP 6xxx series web panels in versions prior to 4.0.10, a remote, unauthenticated attacker may use an attribute of a specific HTTP POST request related to date/time operations to gain full access to the device.