CVE Vulnerability Catalog

ESF-IDF to framework do rozwoju Internetu Rzeczy (IoT) firmy Espressif. W wersjach 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 i wcześniejszych, włączenie AVRCP na ESP32 i otrzymanie źle sformułowanego polecenia VENDOR DEPENDENT od urządzenia partnerskiego może spowodować, że stos Bluetooth uzyska dostęp do pamięci przed zweryfikowaniem długości bufora polecenia.

SQL injection vulnerability in long2ice assyncmy through 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. An attacker can supply malicious dictionary keys to manipulate SQL queries.

code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter. The vulnerability allows manipulation of database queries.

A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd.

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other lower-privileged accounts or invite a new account and escalate its privileges, and can also change the target account's password.

dcat-admin v2.2.3-beta and earlier is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.

Edoc-doctor-appointment-system v1.0.1 contains an SQL injection vulnerability via the 'docid' parameter at /admin/appointment.php.

A non-privileged user can install and remove arbitrary packages via composer in a composer-based installation, even if the flag in update settings for enabling composer-based updates is unticked. A low-privileged user of the platform can install malicious code to obtain higher privileges.

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS) allow a physically proximate attacker to access internal components of the appliance without leaving tamper evidence. To exploit this, the attacker needs to remove the tamper label and all fixing screws without damaging the device. This is called an F14 attack.

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS) allow a user with OS root access to alter firmware on the Chassis Management Board without authentication. This is called F04.

The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11 or 13.7 (patched in 13.6.12 LTS and 13.9.0 STS) allows a physically proximate attacker to obtain debug access and escalate privileges by bypassing the tamper label and opening the chassis without leaving evidence, and accessing the JTAG connector. This is called F02.

SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.

A heap-based buffer overflow vulnerability exists in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 within the 'ShowSupervisorParameters()' function. Unlimited user input is copied to a fixed-size buffer via 'sprintf()' without size validation, allowing an attacker to supply an excessively large 'meter' parameter.

A stack-based buffer overflow vulnerability exists in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2 within the 'SetUserPassword()' function. The 'newPassword' parameter is embedded directly into a shell command string via 'sprintf()' without sanitisation and executed using 'system()', allowing injection of arbitrary shell commands.

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'ShowMeterPasswords()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'ShowMeterDatabase()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'AddEvent()' function, user-controlled username input is copied to a fixed-size buffer (48 bytes) without boundary checking. This can lead to memory corruption and potential remote code execution.

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'ShowDownload()' function uses 'sprintf()' to format a string that includes user-controlled input from 'GetParameter(meter)' in a fixed-size buffer 'acStack_4c' (64 bytes) without checking length. An attacker can provide an overly long 'meter' parameter exceeding the buffer size.

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. In the 'showMeterReport()' function, user input is copied to a fixed-size buffer via 'sprintf()' without size validation. An attacker can provide an overly long 'meter' parameter, leading to buffer overflow.

Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The 'SetLan' function is invoked when a new configuration is applied, activated by a management web request to 'index.cgi'. Parameters are not sanitized, which could lead to command injection.