CVE Vulnerability Catalog

The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_ipv6_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-ipv6-info subcommand of dell get-system-info.

The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-info subcommand of dell get-system-info.

The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _get_dell_system_info_idrac_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the idrac-info subcommand of dell get-system-info.

FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _ipmi_sel_oem_fujitsu_get_sel_entry_long_text function in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c, triggered by malformed Fujitsu SEL long-text responses.

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 5.1.2 via the 'custom_loop_template' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling execution of any PHP code in those files. The vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.

ASUS Control Center has vulnerabilities: Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials. An unauthorized user can obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with hardcoded credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company.

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

Pre-authentication heap overflow vulnerability in MOOS core-moos through 10.4.0 in MOOSCommPkt packet handling. Attackers can declare a negative packet length, leading to writing arbitrary data past a four-byte heap buffer during the HandShake phase.

Buffer overflow vulnerability in MOOS-IvP through 24.8.1 in StringToIvPFunction(), where dimension, piece, and degree counts from encoded BHV_IPF payloads are used without validation. Attackers can supply crafted payloads to write past the IvPBox weight array.

Multiple buffer overflow vulnerabilities in MOOS-IvP through 24.8.1 in IvP function string decoders that trust attacker-controlled length fields. Crafted encoded strings can overflow heap and stack buffers, potentially enabling remote code execution.

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages, allowing any publisher to enroll attacker-controlled shore routes. Attackers can receive bridged vehicle traffic including sensor data and control information.

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted messages to open new listeners and redirect or duplicate traffic.

MOOS essential-moos through 10.0.1 contains an authentication bypass in pShare that accepts UDP datagrams from any source and republishes them with attacker-claimed identity. Attackers can inject messages under spoofed identities or crash the pShare process.

MOOS core-moos through 10.4.0 contains an authentication bypass in the optional MOOSDB HTTP server, allowing unauthenticated clients to write variables. Attackers can modify MOOS variables including actuator and override commands without authentication.

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters to execute arbitrary commands as the uMemWatch process user.

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish messages with command substitution syntax to execute arbitrary commands as the iSay process user.

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.