CVE Vulnerability Catalog

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some Moxa industrial computing products. A low-privileged authenticated attacker with adjacent network access could access sensitive information, including cryptographic key material.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

The Popup Box plugin for WordPress versions 6.4.1 to 6.4.2 is vulnerable to Arbitrary Shortcode Execution. The ays_popup_get_user_ip() function reads client-controlled headers, sanitizes them only with sanitize_text_field(), substitutes the value into popup body where %%user_ip_address%% token appears, and passes the result to do_shortcode(), allowing unauthenticated attackers to execute arbitrary registered shortcodes.

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market. It could allow a local authenticated user to execute arbitrary code with elevated privileges.

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver. A local authenticated user could cause a blue screen error.

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

A flaw was found in WildFly. A user with the Monitor role, the lowest standard RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an arbitrary location, allowing the Monitor role to read back the server configuration, including sensitive credentials, leading to information disclosure.

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market. An attacker on the same logical network could exploit it to execute arbitrary code.

A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

A vulnerability was found in bitcoinj up to 0.17 in the url.openConnection function of PaymentSession.java within the Payment Request Handler component. Manipulating the pki_type argument can lead to server-side request forgery, exploitable remotely, and the exploit has been publicly disclosed.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected.