CVE Vulnerability Catalog

Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.

In the Rack library (modular Ruby web server interface) versions prior to 2.2.23, 3.1.21, and 3.2.6, the Rack::Files#fail method sets the Content-Length header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared length is smaller than the actual bytes sent. An attacker can trigger this mismatch by requesting a non-existent path with percent-encoded UTF-8 characters, leading to incorrect HTTP response framing and potential response desynchronization in deployments relying on the wrong Content-Length value.

In Rack prior to versions 2.2.23, 3.1.21, and 3.2.6, a vulnerability was found in Rack::Sendfile#map_accel_path. Injecting the X-Accel-Mapping header into a regular expression without proper escaping allows an attacker to control the X-Accel-Redirect header, potentially leading to serving unauthorized files via nginx.

Rack before versions 2.2.23, 3.1.21, and 3.2.6 has a denial of service vulnerability due to an unlimited number of byte ranges in the HTTP Range header. An attacker can supply many small overlapping ranges, causing disproportionate CPU, memory, I/O, and bandwidth consumption.

Rack::Static incorrectly evaluates header rules on the raw URL-encoded PATH_INFO, while the file is served after decoding. A request for an encoded variant of a path can bypass the intended security headers.

Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If the root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output.

In the Rack interface (versions before 2.2.23, 3.1.21, and 3.2.6), a DoS vulnerability exists in the Rack::Utils.select_best_encoding method. An unauthenticated attacker can send a request with a crafted Accept-Encoding header, causing excessive CPU consumption by Rack::Deflater.

Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.

In the firmware update mechanism of the Qianniao QN-L23PA0904 device (version 20250721.1640), a vulnerability allows an attacker to gain root access, install backdoors, and exfiltrate data by supplying a crafted iu.sh script from an SD card.

A user enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered on the platform.

A weakness has been identified in Trendnet TEW-657BRM 1.00.1. The function add_wps_client in the file /setup.cgi is affected by OS command injection via manipulation of the argument wl_enrolee_pin. The attack can be launched remotely and the exploit has been made public. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A bypass was found in OWASP Core Rule Set (CRS) before versions 3.3.9 and 4.25.0. By inserting whitespace in the filename (e.g., photo. php), files with dangerous extensions (.php, .phar, .jsp, .jspx) can be uploaded without being blocked.

In Textpattern up to version 4.9.1, the function mt_uploadImage in file rpc/TXP_RPCServer.php (XML-RPC Handler component) is vulnerable to path traversal via manipulation of the file.name argument. Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability in LibRaw up to 0.22.0 in the function LibRaw::nikon_load_padded_packed_raw. Manipulating load_flags/raw_width arguments leads to an out-of-bounds read. The attack can be remote.

A command injection vulnerability was detected in Tenda G103 1.0.0.5 in the action_set_net_settings function of the gpon.lua file. Remote manipulation of arguments like authLoid leads to arbitrary command execution. The exploit is publicly available.

phpMyFAQ before version 4.1.1 contains an XSS vulnerability in the regex-based SVG sanitizer. Attackers with edit_faq permission can upload a malicious SVG that uses HTML entity encoding in javascript: URLs within <a href> attributes, leading to arbitrary JavaScript execution and privilege escalation to full admin takeover.

An information disclosure vulnerability was found in phpMyFAQ prior to version 4.1.1 in the searchCustomPages() method. The escape() function uses real_escape_string(), which does not escape LIKE metacharacters (% and _), allowing an unauthenticated attacker to inject these characters and read unintended records.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript.

Endian Firewall version 3.3.25 and prior have a stored cross-site scripting (XSS) vulnerability via the new_cert_name parameter in /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that executes when other users view the page.