CVE Vulnerability Catalog

Vulnerability in dataCycle-CORE before version 26.06.08 (including 25.07.3). Anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access.

In Wazuh prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow an authenticated cluster peer or attacker with the cluster key to deserialize a malicious callable and execute it under an attacker-controlled RBAC context, leading to full manager compromise.

A vulnerability in EGroupware allows an authenticated attacker to achieve Remote Code Execution (RCE) on the server. If self-registration is enabled, it may be exploitable without authentication. The issue stems from improper authorization checks combined with file write and arbitrary file read primitives.

The HDF5 library is vulnerable to an out-of-bounds read when a file is maliciously crafted – the array datatype size, element count, and element size are inconsistent. The vulnerability only occurs in deliberately altered files, not in normal usage.

Vulnerability in the Parsec file-sharing application: lack of workspace name sanitization allows using a UNC path. If the name is a UNC path, the application may become unresponsive or leak the NTLM hash.

A privilege escalation vulnerability in HCL Commerce could allow denial of service, disclosure of user personal data, and unauthorized administrative operations.

ProFTPD before versions 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.

FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.

Directory Traversal vulnerability in Menyoo 2.0 before commit 729aa48. A local attacker can execute arbitrary code via Spooner file management, VehicleSpawner, WeaponOptions, and PedComponentChanger functionalities.

Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.

In CI4MS (versions before 0.31.9.0), the Pages module does not sanitize page content before saving to the database, and the view renders it without escaping, leading to stored XSS. The attack affects every visitor, including administrators.

A SQL injection vulnerability has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. The flaw exists in the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa, where the Structure_ID parameter is vulnerable to SQL injection. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Tenda AC10 version 16.03.10.09_multi_TDE01 in the fromAdvSetLanip function of the /goform/AdvSetLanip file. Manipulation of the GetValue/SetValue arguments leads to a stack-based buffer overflow, which can be exploited remotely.

Vulnerability in QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. The attack can lead to ownership of arbitrary root-owned files or directories, resulting in root access.

Network-AI before version 5.13.4 has an improper cryptographic signature verification vulnerability in APSAdapter. The default local verifier accepts any non-empty string as valid. An unauthenticated attacker can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain permission tokens for sensitive resources including SHELL_EXEC.

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply configured authorization to GET /approvals/ routes, allowing unauthenticated actors to access sensitive approval data including shell commands, file paths, and risk levels. Additionally, the Access-Control-Allow-Origin: * header enables cross-origin disclosure.

Double-free vulnerability in FreeRDP before version 3.28.0 (3.x through 3.27.1) in freerdp_client_rdp_file_apply_to_settings() when parsing the selectedmonitors field of a .rdp file. An attacker can convince a victim to open a crafted .rdp file with oversized monitor tokens, causing a double-free and potentially code execution.

Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.