CVE Vulnerability Catalog

A vulnerability was found in PX4 PX4-Autopilot up to version 1.16.0. The functions MavlinkLogHandler::state_listing and MavlinkLogHandler::log_entry_from_id in the file src/modules/mavlink/mavlink_log_handler.cpp are affected by a stack-based buffer overflow. The attack requires local access. A patch is identified as commit 338595edd1d235efd885fd5e9f45e7f9dcf4013d.

A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in TRENDnet TEW-822DRE versions 1.00B21 and 1.01B06. The function sub_43ACF4 in the file /boafrm/formWsc is affected by command injection via the peerPin argument. The attack can be executed remotely, and the exploit has been publicly disclosed.

A path traversal vulnerability was found in TinyFileManager up to version 2.6 in tinyfilemanager.php. Manipulation of the fullpath argument allows remote attack. The exploit has been published and the vendor did not respond.

A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to version 3.0.0. The tryAuthenticateWithCookies function in the AuthenticationInterceptor.java file of the Cookie Handler component is affected by improper authentication. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version 4.0.0 fixes this issue.

A vulnerability was identified in ZSPACE Z4Pro+ version 1.0.0440024. The function zfilev2_api_CloseSafe in the file /v2/file/safe/close of the HTTP POST Request Handler component is affected by command injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the addPost function of the file Application/Admin/Controller/FileManageController.class.php of the Administrative Panel component. The manipulation leads to code injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy and the project has not responded to the issue report. This vulnerability only affects products that are no longer supported by the maintainer.

A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. The vulnerability affects the Upload function in application/lib/file/LocalUploader.php of the File Upload Handler component. Manipulation of the File argument can lead to code injection. The attack can be executed remotely, and the exploit has been published.

A vulnerability was detected in ZKTeco BioTime up to versions 9.0.3/9.0.4/9.5.2, affecting an unknown part of the file /base/safe_setting/ of the Endpoint component. Manipulating the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials.

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the Member Endpoint component. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A vulnerability in XCMS (up to 3fab5342cc509945a7ce1b8ec39d19f701b89261) affects the Upload function in Admin/Home/Controller/ProductImageController.class.php of the Backend component. Manipulation of the File argument leads to unrestricted upload. The attack can be launched remotely, and the exploit has been publicly disclosed.

A weakness in getmaxun maxun (up to 0.0.28) affects the router.get function in server/src/routes/auth.ts of the Authentication Endpoint component. Manipulation can lead to improper authorization. The attack can be executed remotely, and the exploit has been made public.

LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.

Yealink T21P_E2 Phone version 52.84.0.15 is vulnerable to directory traversal. A remote attacker with normal privileges can read arbitrary files via a crafted request to the diagnostic component's result read function.

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

IBM System Storage DS8000 in versions DS8A00 R10.1, DS8A00 R10.0, and DS8900F R9.4 may allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of server-side security mechanisms.