Code16

A memory corruption issue allows attackers to cause a Denial of Service (DoS) via a crafted file. This issue is related to Data from Faulting Address controls subsequent Write Address starting at `msvcrt!memcpy+0x0000000000000056`.

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.7.2 Description: The issue allows an authenticated user to inject additional commands into a normal webapp query, resulting in a remote code execution (RCE) vulnerability. Recommendations: For Nagios XI version 5.7.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows an authenticated nagiosadmin user to inject additional commands into a request, potentially leading to remote code execution. The vendor disputes the actionability of the vulnerability due to omitted technical details, which may be disclosed at a later time through a subscription service.

Name of the Vulnerable Software and Affected Versions: ActivePresenter version 6.1.6 Description: The issue is a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution. Recommendations: For ActivePresenter version 6.1.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows post-authentication SQL injection via several parameters, including `typeid` or `site` in "site edit.php", `search title` in "search incidents advanced.php", or `criteriafield` in "report qbe.php".

The issue allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in certain parameters. Specifically, the parameters `cert issuer`, `cert division`, `cert organization`, `cert locality`, `cert state`, `cert country`, or `cert email` in the `index.cgi` are vulnerable.

The issue allows remote authenticated administrators to conduct absolute path traversal attacks. This can be demonstrated by sending a request to the "index.cgi" endpoint with a `filelog` parameter set to `/etc/shadow`, allowing access to sensitive files.

The issue allows for cross-site scripting (XSS) attacks via the `theme` parameter in the "account/main.php" endpoint. This means an attacker could potentially inject malicious scripts into the website, affecting users who access the page.

The issue allows for XSS via the `password` parameter in the includes/components/ldap ad integration/ endpoint.

The issue allows remote command execution for an authenticated user via shell metacharacters in the `hostname` field. This can be exploited by including shell metacharacters in the "Modify the hostname" field.

The issue allows for XSS via the `username` parameter in the includes/components/ldap ad integration/ endpoint.

The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the `server ip` field in JSON data in an "api/internal.php?object=centreon configuration remote" request.

The issue allows for XSS attacks through the `joinfiles`, `topic`, or `code` parameter, or the HTTP Referer header.

The issue allows an authenticated user to execute arbitrary OS commands via shell metacharacters in the `id` parameter to "schedulereport.php", in the context of the web-server user account.

The issue exists due to a cross-site scripting (XSS) flaw. This flaw can be exploited via the `nocscreenapi.php` `host`, `hostgroup`, or `servicegroup` parameter, or the `schedulereport.php` `hour` or `frequency` parameter. Any authenticated user can potentially attack the admin user.

The issue allows for Server-Side Request Forgery (SSRF) via the `call%3Durl` substring followed by a URL in square brackets. This can potentially be exploited by manipulating the URL to access internal resources or services.

The issue allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that triggers a malformed SEH.

The issue is related to a User Mode Write AV starting at ExiVectorRender!StrokeText Blend+0x00000000000003a7.

The issue is related to Heap Corruption, specifically starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.

The issue concerns a User Mode Write AV in Eximious Logo Designer, specifically starting at the `ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfile::BuildGradientColorsTable+0x0000000000000053` location. This indicates a problem with the `BuildGradientColorsTable` function within the `CGradientColorsProfile` class of the `ExiCustomPathLib` library.