CVE Vulnerability Catalog

XWiki Platform is a generic wiki platform that allows executing any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This issue has been patched in XWiki versions 15.1-rc-1 and 14.10.5.

Adiscon LogAnalyzer v4.1.13 and earlier is vulnerable to SQL Injection.

Langchain version 0.0.171 is vulnerable to arbitrary code execution in the load_prompt function.

Zoho ManageEngine ADSelfService Plus through version 6113 has an authentication bypass vulnerability that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving domain controller administrator privileges.

There is a vulnerability in the Notepad app related to improper permission control. Successful exploitation of this vulnerability may lead to privilege escalation, affecting availability and confidentiality.

CVE-2023-2907 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in the Marksoft application.

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Memory safety bugs exist in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.

A newline in a filename could be used to bypass file extension security mechanisms that replace malicious extensions such as .lnk with .download, potentially leading to accidental execution of malicious code. This affects Firefox and Thunderbird on Windows: Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.

An attacker could have caused an out-of-bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. This bug only affects Firefox and Thunderbird for macOS; other operating systems are unaffected. It affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

In Siren Investigate versions before 13.2.2, session keys remain active even after logging out.

A buffer overflow in Nintendo Mario Kart Wii versions RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet.

A buffer overflow in Counter-Strike allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.

In Suricata before version 6.0.13, an adversary controlling an external source of Lua rules may be able to execute Lua code. This issue is addressed in version 6.0.13 by disabling Lua unless the allow-rules option is set to true in the Lua security configuration section.

A vulnerability in the sofa-hessian component of Solon before v2.3.3 allows attackers to execute arbitrary code by providing crafted payload.

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.

In OpenBSD 7.2 before errata 026 and 7.3 before errata 004, as well as in LibreSSL before 3.6.3 and 3.7.x before 3.7.3, a double free or use after free could occur after SSL_clear.

A buffer overflow vulnerability was discovered in the TP-Link Archer AX10 (EU) router firmware version V1.2_230220, specifically in the function FUN_131e8 - 0x132B4. This could allow an attacker to execute arbitrary code or cause a denial of service.