CVE Vulnerability Catalog

In YesWiki prior to version 4.6.0, a stored and blind XSS vulnerability was found in the form title field. An unauthenticated attacker can inject JavaScript that executes when other users visit the page.

Poetry, a dependency manager for Python, from version 1.4.0 to before 2.3.3 allows arbitrary file write via a crafted wheel containing ../ paths. The attack is reachable during normal package install flows.

Postiz prior to version 2.21.4 has a blind SSRF vulnerability in the POST /webhooks/ endpoint. URL validation does not block internal/private addresses, allowing attackers to make requests to internal services.

listmonk versions 4.1.0 to before 6.1.0 have bugs in list permission checks that allow users in a multi-user environment to access lists they don't have permission to. This only affects multi-user environments with untrusted users.

In SillyTavern prior to version 1.17.0, an SSRF vulnerability was found in the search.js function. Hostname validation only covers dotted-quad IPv4, allowing bypass via localhost, IPv6, and DNS names resolving to internal addresses. A port check limits exploitation to default ports, reducing risk.

SillyTavern before version 1.17.0 has a path traversal vulnerability in static file handling. An unauthenticated attacker can check for the existence of arbitrary files on the server by sending percent-encoded "../" sequences.

TP-Link Tapo C520WS v2.6 has a DoS vulnerability in HTTP request path parsing. Failure to account for path expansion during normalization leads to buffer overflow and memory corruption, potentially causing device reboot.

In TP-Link Tapo C520WS v2.6, a stack-based buffer overflow vulnerability was identified in a configuration handling component due to insufficient input validation. An attacker can supply an excessively long value for a vulnerable configuration parameter, causing a stack overflow. Successful exploitation leads to a Denial-of-Service (DoS) condition, causing service crash or device reboot.

TP-Link Tapo C520WS v2.6 has a heap-based buffer overflow in asynchronous parsing of local video streams. An attacker on the same network can send crafted payloads causing memory corruption and denial of service (DoS).

TP-Link Tapo C520WS v2.6 has a heap-based buffer overflow in the HTTP parsing loop when appending segmented request bodies. An attacker on the same network can send crafted payloads causing memory corruption and denial of service (DoS).

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation and insufficient boundary validation. An attacker on the same network segment could trigger heap memory corruption by sending crafted payloads.

Acronis True Image for Windows before build 42902 has a local privilege escalation vulnerability due to insecure folder permissions.

Rack before versions 3.1.21 and 3.2.6 incorrectly parses the Forwarded header (RFC 7239) by splitting on semicolons before handling quoted-string values. Since quoted values may contain semicolons, the header can be interpreted as multiple Forwarded directives, allowing attackers to smuggle host, proto, for, or by parameters.

Local privilege escalation vulnerability due to DLL hijacking in Acronis True Image (Windows) before build 42902.

Local privilege escalation vulnerability due to DLL hijacking. Affects Acronis True Image for Windows before build 42902.

Rack::Multipart::Parser incorrectly unfolds folded multipart headers, preserving CRLF in parameter values. This can lead to header injection or HTTP response splitting in applications using these values.

A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. The function vpn_drop in the file /setup.cgi is affected by OS command injection via manipulation of the argument policy_name. The attack can be launched remotely and the exploit has been disclosed. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A flaw has been found in Trendnet TEW-657BRM 1.00.1. The function vpn_connect in the file /setup.cgi is affected by OS command injection via manipulation of the argument policy_name. The attack can be launched remotely and the exploit has been published. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. The function ping_test in the file /setup.cgi is affected by OS command injection via manipulation of the argument c4_IPAddr. The attack can be launched remotely and the exploit is now public. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

An OS command injection vulnerability was found in Trendnet TEW-657BRM router version 1.00.1 in the Edit function of the /setup.cgi file. Manipulating the pcdb_list argument allows remote command execution. The vendor confirmed the product is discontinued and unsupported since 2011.