CVE Vulnerability Catalog

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances.

D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.

A vulnerability in Origin Software ATS Pro allows authorization bypass through a user-controlled key, leading to authentication abuse.

CVE-2023-3376 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Digital Strategy Zekiweb system. This issue affects Zekiweb versions before 2.

The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.

CVE-2023-2963 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection in Oliva Expertise EKS versions before 1.2.

There is a prototype pollution vulnerability in the GitHub repository automattic/mongoose prior to version 7.3.4.

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in the changepwd.cgi application.

IQ Engine before version 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevated privileges for remote code execution.

The WAYOS FBM-291W version 19.09.11V was found to contain a command injection vulnerability via the component /upgrade_filter.asp.

The WAYOS FBM-291W version 19.09.11V was found to contain a buffer overflow vulnerability in the component /upgrade_filter.asp.

Netkit-rcp in rsh-client version 0.17-24 allows command injection via filenames because /bin/sh is used by susystem. This is related to issues described in CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.

XWiki Platform has a vulnerability due to improper escaping in the `SkinsCode.XWikiSkinsSheet` document. This allows attackers to execute arbitrary script macros, including Groovy and Python, leading to remote code execution and unrestricted access to wiki content.

A stack overflow was discovered in the page parameter in the function fromqossetting in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.

A stack overflow was discovered in the page parameter in the function fromSafeUrlFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.

A stack overflow was discovered in the page parameter in the function fromSafeMacFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.

A stack overflow was discovered in the page parameter in the function fromP2pListFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.

A stack overflow was discovered in the page parameter in the function fromSafeClientFilter in Tenda F1202 V1.0BR_V1.2.0.20(408) and FH1202_V1.2.0.19_EN devices.

A stack overflow was discovered in the page parameter in the function fromDhcpListClient in Tenda F1202, FH1202, AC10, AC1206, AC7, AC5, and AC9 devices.