CVE Vulnerability Catalog

Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.

Command argument injection vulnerability in Cosminexus Component Container. Allows an attacker to execute unauthorized system commands.

OS command injection vulnerability in Cosminexus Component Container. Allows an attacker to execute arbitrary commands on the server.

Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.

Vulnerability in the OIS web module of Siveillance Control allows an attacker to upload arbitrary files to the server. Successful exploitation could allow an attacker to gain root access on the host system, potentially leading to full compromise of the OIS environment.

Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.

The D-Link DIR-822A router version A_101 has a vulnerability in the tunnel_set_params function of the L2TP Control Message Parser component, leading to an out-of-bounds write. The attack can be launched remotely, and the exploit has been publicly disclosed.

The D-Link DIR-895L router version A1_102b07 has a vulnerability in the sendOffer/sendACK functions of the file udhcpcd/serverpacket.c in the udhcpcd component, causing a stack-based buffer overflow. The attack can only be performed within the local network, and the exploit has been published.

The @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application, and partial impact on confidentiality of business data.

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on confidentiality, integrity, and availability.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access could register an unauthorized component and potentially perform unauthorized actions, resulting in high impact on confidentiality, integrity, and availability.

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request with a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have high impact on confidentiality, integrity, and availability.

Vulnerability in knowns before version 0.30.0 serves the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

Vulnerability in knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.

In JetBrains Hub before 2026.2.52442, an unauthenticated attacker could register a trusted service and gain superuser privileges.

In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM versions before 8.0.3.

In 389 Directory Server, during SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.