CVE Vulnerability Catalog

The Aerospike Java client prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 deserializes Java objects from server responses without proper validation. Attackers can exploit this vulnerability to inject malicious code, potentially taking control of the client machine.

Version django-sspanel v2022.2.2 was found to contain a remote command execution (RCE) vulnerability in the component sspanel/admin_view.py in the GoodsCreateView._post method.

In PHPJabbers Cleaning Business Software version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

In PHP Jabbers Class Scheduling System version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

PHPJabbers Availability Booking Calendar version 5.0 is vulnerable to User Account Takeover through username/password change.

PHP Jabbers Availability Booking Calendar version 5.0 is vulnerable to Incorrect Access Control.

PHPJabbers Availability Booking Calendar version 5.0 is vulnerable to Incorrect Access Control due to improper input validation of the password parameter.

In ai-dev aitable versions before v0.2.2, a SQL injection vulnerability was discovered in the component /includes/ajax.php.

A vulnerability in ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server. It exploits a path traversal issue in the Username field and lack of input sanitization on the SSH Key field in /base/sftpsetting/ endpoints.

Versions before 0.1.3 of the ai-dev aioptimizedcombinations library were found to contain a SQL injection vulnerability via the component /includes/ajax.php.

Dango-Translator v4.5.5 was found to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.json.

CVE-2023-36217 is a Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 that allows a remote attacker to execute arbitrary code via the category name field of the image manager function.

MotoCMS version 3.4.3 contains an SQL injection vulnerability that allows a remote attacker to gain privileges via the keyword parameter of the search function.

CVE-2023-3346 in MITSUBSHI CNC Series has a buffer overflow vulnerability that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition and execute arbitrary code on the device by sending specially crafted packets. A system reset is also required for recovery.

A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.

In WS-Inc J WBEM Server version 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. This allows context-dependent attackers to read arbitrary files or cause a denial of service.

A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.

A vulnerability in the GatesAir Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to obtain LDAP and SMTP credentials, potentially leading to privilege escalation.

IDSecure version 4.7.26.0 and prior uses a hardcoded cryptographic key to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.

A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.