CVE Vulnerability Catalog

NVIDIA Isaac Launchable contains a vulnerability where an attacker could cause execution with unnecessary privileges. A successful exploit might lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering.

NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit might lead to code execution, privilege escalation, denial of service, and data tampering.

Linksys E5600 version V1.1.0.26 is vulnerable to command injection in the ddnsStatus function. The description provides no further technical details.

Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter. An attacker can supply a crafted parameter value to execute arbitrary commands on the device.

SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.

In Eclipse Cyclone DDS before version 0.10.5, improper verification of the time certificate allows attackers to bypass certificate checks and execute commands with System privileges.

eProsima Fast-DDS version 3.3 was found to have improper validation for ticket revocation, resulting in insecure communications and connections.

Netgear EX8000 version V1.0.0.126 contains a command injection vulnerability via the switch_status function. The description provides no further technical details.

In the Linux kernel, the veth interface has a race condition related to the xdp_no_direct section. After NAPI completion, another CPU may start a new NAPI instance, leading to concurrent access to the BPF context and a potential race.

Wtyczka PhastPress dla WordPressa jest podatna na nieautoryzowane odczyty plików poprzez wstrzyknięcie bajtu null we wszystkich wersjach do 3.7 włącznie. Problem wynika z niezgodności w walidacji rozszerzeń, co umożliwia atakującym odczyt dowolnych plików z katalogu głównego, w tym wp-config.php.

net-snmp to biblioteka aplikacji SNMP, narzędzia i demon. Przed wersjami 5.9.5 i 5.10.pre2, specjalnie skonstruowany pakiet wysłany do demona snmptrapd może spowodować przepełnienie bufora i awarię demona.

An authentication bypass vulnerability in Xiongmai XM530 IP cameras running Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access.

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.

Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

ClipBucket 5.5.2 is shipped with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the admin panel, gaining full administrative control of the application.