CVE Vulnerability Catalog

An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass authentication and execute arbitrary code via crafted HTTP request.

Wtyczka Media Library Assistant dla WordPressa jest podatna na lokalne włączenie plików oraz zdalne wykonanie kodu w wersjach do 3.09 włącznie. Problem wynika z niewystarczających zabezpieczeń dotyczących ścieżek plików przekazywanych do parametru 'mla_stream_file'.

A file upload vulnerability in bolo-solo version 2.6 allows a remote attacker to execute arbitrary code by sending a crafted script in the authorization header. This can lead to full server compromise.

CVE-2023-4531 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities in Mestav's e-commerce software. This issue affects versions of the software before 20230901.

A vulnerability in Neutron Smart VMS allows authentication bypass via spoofing. This affects versions before b1130.1.0.1.

A SQL Injection vulnerability in Digita Information Technology's Smartrise Document Management System due to improper neutralization of special elements used in SQL commands. This issue affects versions before Hvl-2.0.

The Mava Software Hotel Management System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions of the system before 2.0.

CVE-2023-35072 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in the Coyav Travel Proagent application. This issue affects Proagent versions before 20230904.

The BMA Personnel Tracking System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 20230904.

CVE-2023-35065 describes an improper neutralization of special elements used in SQL commands, allowing SQL Injection in Osoft Paint Production Management. This issue affects versions before 2.1.

CVE-2023-3374 vulnerability in Unisign Bookreen allows for privilege escalation due to an incomplete list of disallowed inputs. This issue affects Bookreen versions before 3.0.0.

Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter. An attacker can manipulate database queries, potentially leading to unauthorized data access.

A critical vulnerability was found in Tenda AC8 version 16.03.34.06_cn_TDC01 in the formSetDeviceName function, leading to stack-based buffer overflow. The vulnerability can be exploited remotely.

Proscend Advice ICR Series routers FW version 1.76 have a vulnerability related to the use of default credentials, which may lead to unauthorized access.

There is a vulnerability in MXsecurity versions prior to 1.0.1 that can be exploited to bypass authentication. A remote attacker might access the system if the web service authenticator has insufficient random values.

CVE-2023-40980 in DWSurvey DWSurvey-OSS version 3.2.0 and earlier allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file.

Version 0.0.245 of the LanChain-ai Langchain library contains a vulnerability that allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Integer Overflow vulnerability in mp_grow in libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 allows attackers to execute arbitrary code and cause a denial of service (DoS).

CVE-2023-36327 describes an integer overflow vulnerability in the RELIC library before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allowing attackers to execute arbitrary code and cause a denial of service in the pos argument of the bn_get_prime function.

An Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling the realloc function in the bn_grow function.