CVE Catalog

A vulnerability allowing information disclosure has been identified in the GeoVision GV-ASManager web application, specifically in versions through 6.1.0.0. This vulnerability exposes account information, including passwords in cleartext.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Geovision GV-ASWeb application, specifically in versions 6.1.1.0 and earlier. This vulnerability allows attackers to create Administrator accounts arbitrarily by sending a crafted GET request. The issue can be exploited in conjunction with CVE-2024-56903 to execute a successful CSRF attack.

A broken access control vulnerability has been identified in GeoVision GV-ASWeb versions through 6.1.0.0. This vulnerability enables low-privilege users to perform unauthorized actions, which can be exploited to escalate privileges and manage user accounts. Specifically, affected users can create, modify, or delete accounts, and manipulate access controls.

A reflected cross-site scripting vulnerability has been identified in Quorum onQ OS version 6.0.0.5.2064. This vulnerability allows remote attackers to obtain sensitive information by exploiting the 'msg' parameter on the Login page.

An API key disclosure vulnerability has been identified in the Nedis SmartLife Android application, specifically in version 1.4.0. This vulnerability allows for the unintentional exposure of sensitive API keys, which could potentially be exploited inappropriately.

A vulnerability in the Nedis SmartLife Video Doorbell model WIFICDP10GY, specifically in the Nedis SmartLife iOS application version 1.4.0, allows users who have disconnected from a previous peer-to-peer connection with the doorbell to still access the live video feed. This issue raises concerns about privacy and unauthorized surveillance.

A vulnerability allowing arbitrary file read has been identified in the Digiever DS-2105 Pro model, specifically in version 3.1.0.71-11. This issue arises in the access_device.cgi script, which is part of the device's CGI gateway. The vulnerability is present on devices that are no longer supported by the manufacturer.

A command injection vulnerability has been identified in Digiever DS-2105 Pro devices running version 3.1.0.71-11. This vulnerability allows authenticated users to inject commands through the 'time_tzsetup.cgi' CGI script. The issue arises because the device's management interface can be exposed to the Internet, potentially allowing unauthorized access.

A SQL injection vulnerability has been identified in the Advantive VeraCore application, specifically in the timeoutWarning.asp file, in versions through 2025.1.0. This vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the PmSess1 parameter. The issue arises because the application concatenates user input with static strings to form SQL queries, creating an opportunity for injection.

A server-side request forgery (SSRF) vulnerability has been identified in the RSS feed parser of Zimbra Collaboration. This vulnerability is present in version 9.0.0 prior to Patch 43, as well as in the 10.0.x and 10.1.x versions prior to their respective patch releases. The vulnerability allows unauthorized redirection to internal network endpoints.

A SQL injection vulnerability has been identified in the ZimbraSync Service SOAP endpoint of Zimbra Collaboration versions 10.0.x prior to 10.0.12 and 10.1.x prior to 10.1.4. This vulnerability arises from inadequate sanitization of user-supplied parameters, allowing authenticated attackers to manipulate requests and inject arbitrary SQL queries that could be used to retrieve email metadata.

A CSV injection vulnerability has been identified in the exception log download module of Eladmin versions through 2.7. This issue allows for the injection of malicious CSV formulas into the exported log files, which could be executed when the file is opened in a spreadsheet application.

An upload validation vulnerability has been identified in Advantive VeraCore versions prior to 2024.4.2.1. This vulnerability allows remote authenticated users to upload files to unintended directories that may be accessible during web browsing by other users. The issue arises because the application only verifies the size of the uploaded files, and if not properly configured, the uploaded files can be accessed via the web server.

A directory traversal vulnerability has been identified in the Zrlog backup-sql-file plugin, version 3.0.31. This vulnerability allows remote attackers to access sensitive information by exploiting the BackupController.java file. The issue arises because the file parameter is not properly sanitized, enabling arbitrary file downloads.

A stored cross-site scripting vulnerability has been identified in sayski ForestBlog, specifically in the article editing interface of the administrator backend. This issue allows remote attackers to inject malicious scripts that could be executed in the context of the user's session, potentially leading to unauthorized actions or access.

An arbitrary file deletion vulnerability has been identified in ChestnutCMS versions through 1.5.0. The issue resides in the contentcore.controller.FileController, where attackers can delete any file or folder.

A file upload vulnerability has been identified in ChestnutCMS versions through 1.5.0. This issue arises in the Create template function, allowing unauthorized file uploads.

A code execution vulnerability exists in ClassCMS version 4.8. This issue allows attackers to execute arbitrary code by crafting a payload in the classview parameter within the model management feature of the administrator backend. Exploitation of this vulnerability could lead to unauthorized control over the server.

A SQL injection vulnerability has been identified in Moss version 0.1.3. This vulnerability allows attackers to inject malicious SQL payloads into the 'order' parameter. The injection can be exploited through several admin API endpoints, including article, category, tag, link, and store lists, after logging into the backend.

A stored cross-site scripting vulnerability has been identified in ClassCMS version 4.8. The issue resides in the channel management interface, specifically within the 'class/admin/channel.php' file. The vulnerability occurs because user input is not properly sanitized, allowing for the injection of malicious scripts.

A denial-of-service vulnerability has been identified in Technitium DNS Server versions through 13.2.2. This issue allows remote attackers to permanently disrupt the server's ability to accept new DNS-over-QUIC connections by causing unhandled exceptions in the listener threads.

A denial-of-service vulnerability has been identified in Open5GS version 2.7.2. The issue arises in the Access and Mobility Management Function (AMF) when it receives the Nausf_UEAuthentication_Authenticate response. If the Initial UE Message registration request is sent repeatedly by the same user equipment (UE) before the previous authentication response is processed, the AMF crashes. This failure is due to improper error handling in the gmm_state_exception function, which cannot manage the outdated authentication vectors, leading to a crash.

A local file inclusion vulnerability has been identified in the BoomBox Theme Extensions plugin for WordPress, affecting all versions through 1.8.0. The vulnerability arises in the 'boombox_listing' shortcode, specifically within the 'type' attribute. This flaw allows authenticated attackers with contributor-level permissions or higher to include and execute arbitrary files on the server. Exploitation of this vulnerability could lead to the execution of PHP code contained in the included files, potentially bypassing access controls, accessing sensitive data, or executing code in scenarios where PHP files can be uploaded and included.

A vulnerability exists in Xerox VersaLink, Phaser, and WorkCentre printers that allows users with address book access to modify SMB or FTP settings. This could redirect scan functions and potentially capture credentials. Exploitation requires the scan functions to be enabled and access to the printer.

A vulnerability exists in the Eventer plugin for WordPress, all versions through 3.9.9, allowing unauthorized data access. The issue arises from a missing capability check in the 'eventer_export_bookings_csv' function. This flaw enables authenticated attackers with subscriber-level permissions or higher to download booking data containing personal information of customers.

A vulnerability exists in the Eventer plugin for WordPress, specifically in versions through 3.9.9.5, due to a lack of proper capability checks in the 'handle_pdf_download_request' function. This oversight allows unauthenticated users to download event tickets, unauthorized access to event ticket data.

A stored cross-site scripting vulnerability has been identified in the Eventer plugin for WordPress, affecting versions through 3.9.9.4. The issue arises from inadequate input sanitization and output escaping of user-supplied attributes in shortcodes. This vulnerability allows authenticated attackers with contributor-level or higher permissions to inject arbitrary scripts into pages, which are executed when users access the affected pages.

A SQL injection vulnerability has been identified in the Prolink 4G LTE Mobile Wi-Fi DL-7203E device, specifically in version 4.0.0B05. The issue arises in the '/reqproc/proc_get' endpoint, where an attacker can inject malicious SQL code into the 'order_by' parameter, potentially manipulating SQL queries and accessing or modifying database information.

A cross-site scripting (XSS) vulnerability has been identified in the Prolink 4G LTE Mobile Wi-Fi DL-7203E device, specifically in version V4.0.0B05. The issue occurs in the /reqproc/proc_get endpoint, where the cmd parameter fails to properly sanitize input. As a result, injected JavaScript code can be executed by the browser, since the response is delivered with a Content-Type of text/html.

A Cross-Site Scripting (XSS) vulnerability exists in Roundcube Webmail version 1.6.9. This issue allows remote authenticated users to upload malicious files as email attachments. The XSS is triggered when the SENT session is accessed.

A cross-site scripting (XSS) vulnerability has been identified in the itsourcecode Placement Management System version 1.0. The issue arises in the Full Name and email address fields of the registration.php file, allowing attackers to inject malicious scripts.

A vulnerability exists in certain Xerox products that could lead to unauthorized authentication redirection in LDAP configurations, potentially exposing user credentials. This issue requires administrative access and an active LDAP setup to be exploited.

A use-after-free vulnerability has been identified in the rust-openssl crate, specifically in versions 0.10.0 prior to 0.10.70. The issue arises in the `ssl::select_next_proto` function, which can return a slice pointing into the server buffer but with a lifetime tied to the client buffer. If the server buffer's lifetime is shorter than that of the client, it can lead to a use-after-free condition. This vulnerability may cause the server to crash or to leak arbitrary memory contents to the client.

A vulnerability in the Password Vault Web Access (PVWA) component of CyberArk Privileged Access Manager Self-Hosted, prior to version 14.4, allows for potentially elevated privileges through improper handling of LDAP mapping. This issue could be exploited by manipulating group mapping parameters, leading to unauthorized access or privileges.

A stored cross-site scripting vulnerability has been identified in PHPGURUKUL Online Birth Certificate System version 1.0. The issue arises in the '/user/certificate-form.php' page, where authenticated users can inject malicious scripts into the profile name field. This injection can lead to the execution of arbitrary JavaScript on the client side, with potential consequences such as data theft or session hijacking.

A vulnerability exists in the microcode patch loader of AMD CPUs, specifically in the Zen 1-4 architectures. This issue arises from improper signature verification, allowing an attacker with local administrator privileges to load malicious microcode patches. The vulnerability could compromise the confidentiality and integrity of sensitive workloads running under AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) feature.

A host header injection vulnerability has been identified in CyberArk Privileged Access Manager Self-Hosted (PVWA) versions prior to 14.4. This vulnerability allows for open redirection by improperly handling the 'Host' header, which can be manipulated to redirect users to an attacker-controlled domain. The issue arises from environmental misconfigurations that contribute to host header injection.

A cross-site scripting (XSS) vulnerability has been identified in NRadio N8-180 devices running NROS version 1.9.2.n3.c5. The issue arises in the /cgi-bin/luci/nradio/basic/radio endpoint, where the 2.4 GHz and 5 GHz name parameters are susceptible to XSS. This allows an attacker to inject JavaScript into the SSID field, which is then executed in the context of the current user. If an administrator is logged into the device, the injected script runs in their browser, executing the malicious payload.

A command injection vulnerability has been identified in NRadio N8-180 devices running NROS-1.9.2.n3.c5. The issue arises in the '/cgi-bin/luci/nradio/basic/radio' endpoint, where the 2.4 GHz and 5 GHz name parameters can be exploited. This vulnerability allows remote attackers to execute arbitrary operating system commands on the device with root-level permissions by injecting crafted input into the WiFi SSID fields.

A vulnerability in the TextNow application for Android, specifically version 24.17.0.2, allows any installed app to make phone calls without user interaction. This is achieved by sending a specially crafted intent to the DialerActivity component, bypassing normal permission requirements.

A segmentation fault vulnerability has been identified in lunasvg version 3.0.1. The issue arises in the gray_find_cell function within the plutovg-ft-raster.c file, leading to a segmentation violation when rendering SVGs with AddressSanitizer enabled. This vulnerability can be reproduced using the svg2png example included with the lunasvg distribution.

A memory corruption vulnerability has been identified in Qualcomm Snapdragon processors. This issue arises while processing IOCTL commands from user space, specifically in relation to handling GPU AHB bus errors. The vulnerability could potentially be exploited to cause memory corruption, leading to undefined behavior or allowing for arbitrary code execution.

A memory corruption vulnerability has been identified in certain Qualcomm products. This issue arises when user-space IOCTL calls are invoked to validate FIPS encryption or decryption functionality, potentially leading to unauthorized memory access or manipulation.

A memory corruption vulnerability has been identified in certain Qualcomm products, arising during the processing of management frames. This issue is due to a mismatch in the T2LM information element, which can lead to improper memory handling.

A buffer over-read vulnerability has been identified in the WLAN Host component of various chipsets. This vulnerability allows for information disclosure while parsing the OCI Information Element (IE) with invalid length. The issue arises from improper validation of frame content, leading to memory corruption during the processing of management frames.

A memory corruption vulnerability has been identified in Qualcomm Snapdragon CPUs, occurring while reading CPU state data during the suspension of guest virtual machines. This issue could potentially be exploited to cause unintended behavior or system instability.

A memory corruption vulnerability has been identified in the power-up or power-down sequence of the camera sensor, which could potentially be exploited under certain conditions.

A memory corruption vulnerability has been identified in the camera component of Qualcomm Snapdragon processors. This issue arises when an invalid Camera ID (CID) is used, potentially leading to unintended behavior or exploitation.

A memory corruption vulnerability has been identified in the camera driver of various chipsets due to improper validation of array indices. This issue arises when an unusually high number of nodes are passed to the AXI port, leading to memory corruption. The vulnerability is present in several chipsets, including those used in mobile platforms and automotive applications.

A memory corruption vulnerability exists in certain Qualcomm products when a compat IOCTL call is immediately followed by a standard IOCTL call from userspace. This issue can lead to unintended memory manipulation or access.