CVE Vulnerability Catalog

In FUXA (web-based Process Visualization SCADA/HMI/Dashboard software) versions 1.2.11 through 1.3.1, an unauthenticated remote attacker can achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even in the most secure configuration (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

Vulnerability in Oracle Application Testing Suite version 13.3.0.1. An easily exploitable flaw allows an unauthenticated attacker with network access via TCP to gain full access to all application data.

SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to SQL Injection in the file /edit_subjecta.php via manipulation of the ID argument. The attack can be performed remotely.

A vulnerability in the Bluetooth BR/EDR (Classic) stack of Zephyr RTOS affects L2CAP configuration handlers (l2cap_br_conf_req and l2cap_br_conf_rsp). The minimum command size validation used buf->len (bytes remaining in the whole PDU) instead of len (per-command data length from the L2CAP header). An attacker can send a CONF_REQ command with a header smaller than the configuration-request structure (e.g., 0) followed by another command, causing buf->len to still pass the check. This leads to an underflow of opt_len to near 0xFFFF, resulting in an out-of-bounds read and potential out-of-bounds write when option bytes encode MTU or flush-timeout.

A vulnerability in Zephyr (MCTP-over-I2C+GPIO) allows an attacker to write an arbitrary byte via an uninitialized pointer and a one-byte heap overflow. Lack of validation of write order and receive buffer enables remote memory corruption or system crash.

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges.

SSRF vulnerability in mcp-webresearch 0.1.7 allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool. The attack can expose sensitive data, including credentials.

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

SSRF vulnerability in LMDeploy up to version 0.14.0 (fixed in commit 03c3130) in the _load_http_url function in connection.py. The private-IP guard only validates the original URL without re-validating hosts after HTTP redirects.

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana allows unauthorized information disclosure and compromise of case attachment integrity. A low-privileged authenticated user can read, modify, and delete case attachments they are not authorized to access, including those related to Security Solution.

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file.

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

Shelf prior to version 1.20.2 has an IDOR vulnerability that allows an authenticated user from organization A to access data of organization B by manipulating entity IDs. Additionally, booking restrictions can be bypassed via a crafted POST request.

Vulnerability in CC: Tweaked mod for Minecraft. Prior to version 1.119.0, the HTTP API blocks requests to private network ranges to prevent SSRF. This protection can be bypassed on IPv6-capable servers using NAT64 prefix addresses (`64:ff9b::/96`). An attacker executing Lua code can reach internal IPv4 services by addressing them as `http://[64:ff9b::<ipv4-as-hex>]/`. Affects deployments on networks with NAT64 routing, standard on AWS, GCP, etc. Version 1.119.0 fixes the issue.

Vulnerability in the MeltanoHub repository (source code of hub.meltano.com) prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173. A dangerous CI/CD workflow (pull_request_target) allowed exfiltration of a GITHUB_TOKEN with write permissions.

Vulnerability in FOG (imaging/inventory management system). An unauthenticated attacker can remotely wipe AES keys and delete power management tasks via a single HTTP GET request.

XSS vulnerability in FOG (open-source cloning/imaging tool) allows an unauthenticated attacker who knows a host's MAC address to inject malicious JavaScript via the sysproduct parameter. The payload executes in the admin's browser when viewing inventory reports.

Vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders static inventory fields without output encoding, allowing stored XSS in any administrator's browser.

Vulnerability in Kubeflow Community Distribution before version 26.03-rc.1 allows stealing authorization tokens from users with kubeflow-edit role, leading to account takeover.