CVE Vulnerability Catalog

Rack prior to versions 2.2.23, 3.1.21, and 3.2.6 does not limit the size of data in multipart/form-data requests without a Content-Length header. An attacker can send an arbitrarily large file, causing disk space exhaustion and denial of service (DoS).

Rack versions before 2.2.23, 3.1.21, and 3.2.6 improperly validate URL prefixes in Rack::Static, potentially leading to unauthorized static file serving and information disclosure.

Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.

A vulnerability in Apache Traffic Server (versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1) allows request smuggling if chunked messages are malformed.

A bug in POST request handling causes a crash under a certain condition in Apache Traffic Server versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12. The issue is fixed in versions 10.1.2 and 9.2.13. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0.

A vulnerability in the discontinued Trendnet TEW-657BRM router (version 1.00.1) allows remote stack-based buffer overflow via the mac_pc_dba argument in /setup.cgi. The vendor confirmed the product is end-of-life and no longer supported.

A stack-based buffer overflow vulnerability was identified in Trendnet TEW-657BRM version 1.00.1 in the add_apcdb function of /setup.cgi via the mac_pc_dba argument. The attack can be performed remotely and the exploit is publicly available. The vendor confirmed the product is end-of-life since 2011 and no longer supported.

Mbed TLS 3.x before 3.6.6 has an out-of-bounds read vulnerability in mbedtls_ccm_finish() due to missing validation of the tag_len parameter. An attacker can obtain adjacent CCM context data.

Balena Etcher for Windows prior to version 2.1.4 has a TOCTOU race condition vulnerability that allows attackers to escalate privileges and execute arbitrary code by replacing a legitimate script with a crafted payload during the flashing process.

Vulnerability in hm_editor up to version 2.2.3 in the image-to-base64 Endpoint component. The client.get function in src/mcp-server.js allows manipulation of the url argument, leading to server-side request forgery (SSRF). Remote attack, exploit publicly disclosed.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_smtp.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

Endian Firewall version 3.3.25 and earlier allows authenticated users to execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_openvpn.cgi. The parameter value is used to build a file path passed to Perl's open() function, enabling command injection due to incomplete regex validation.

Endian Firewall version 3.3.25 and earlier allows authenticated users to execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_log.cgi. The parameter value is used to build a file path passed to Perl's open() function, enabling command injection due to incomplete regex validation.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_ids.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_firewall.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

In Endian Firewall version 3.3.25 and prior, authenticated users can execute arbitrary OS commands via the DATE parameter in /cgi-bin/logs_clamav.cgi. The parameter value is used to construct a file path passed to a Perl open() call, allowing command injection due to incomplete regex validation.

Firewall Endian w wersji 3.3.25 i wcześniejszych pozwala uwierzytelnionym użytkownikom na wykonywanie dowolnych poleceń systemowych poprzez parametr DATE w /cgi-bin/logs_proxy.cgi. Wartość parametru DATE jest używana do skonstruowania ścieżki pliku, która jest przekazywana do wywołania Perl open(), co umożliwia wstrzyknięcie poleceń z powodu niekompletnej walidacji wyrażenia regularnego.

Firewall Endian w wersji 3.3.25 i wcześniejszych pozwala uwierzytelnionym użytkownikom na usuwanie dowolnych plików poprzez atak typu directory traversal w parametrze remove ARCHIVE w /cgi-bin/backup.cgi. Wartość parametru remove ARCHIVE jest używana do konstruowania ścieżki pliku bez sanitizacji sekwencji przejścia katalogu.

phpMyFAQ to otwartoźródłowa aplikacja webowa do zarządzania pytaniami i odpowiedziami. W wersjach przed 4.1.1 metoda MediaBrowserController::index() obsługuje usuwanie plików w przeglądarce mediów, jednak nie weryfikuje poprawności ścieżek, co umożliwia ataki typu traversal. Dodatkowo, brak walidacji tokenów CSRF czyni ten punkt końcowy podatnym na ataki CSRF.

Glances to narzędzie do monitorowania systemów, które przed wersją 4.5.3 obsługiwało dynamiczne wartości konfiguracyjne, w których podciągi otoczone znakami ` były wykonywane jako polecenia systemowe podczas analizy konfiguracji. Ta funkcjonalność nie była odpowiednio walidowana, co stwarza ryzyko wykonania dowolnych poleceń.