CVE Vulnerability Catalog

A vulnerability was identified in D-Link DIR-825 3.00b32 in the tunnel_set_params function of tunnel.c in the rp-l2tp component. Manipulation of the peer_hostname argument leads to an out-of-bounds write. The attack may be initiated remotely.

A vulnerability in MantisZip up to 0.4.5. The Path.Combine function in MainWindow.UI.cs of the Preview component leads to path traversal. The attack can be launched remotely. The exploit has been released.

A vulnerability in TaleLin lin-cms-spring-boot up to 0.2.1. The searchBook function in BookController.java of the book Endpoint leads to improper authorization. The attack can be launched remotely. The exploit is publicly available.

A vulnerability in TaleLin lin-cms-spring-boot up to 0.2.1. The getBooks function in BookController.java of the book Endpoint leads to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed.

SigNoz versions from v0.98.0 up to v0.143.0, when configured with the opaque session tokenizer, do not revoke a user's existing login sessions when the user's password is reset with a reset token or when the user is deleted. An attacker who already holds a session token retains full access to the account, up to administrator, after a password reset until the token reaches its maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default).

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret to an empty string, and Config.Validate() does not reject the empty value, so a deployment without a configured secret signs and verifies session tokens with an empty HMAC key. An unauthenticated attacker who knows an existing user's ID can forge a valid session token for that user, including an administrator.

A vulnerability was found in TaleLin lin-cms-spring-boot up to version 0.2.1 in the getBook function of BookController. Manipulation of the ID argument leads to improper authorization. The attack can be performed remotely and the exploit has been published.

A vulnerability was identified in huanzi-qch base-admin in the Save function of CommonController.java (Add User Handler component). Manipulation of the Username argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was identified in java110 MicroCommunity up to 2.0 in the QueryServiceSMOImpl.fallBack function of BusinessApi.java in the fallBack API Endpoint component. Manipulation of the fallBackSql argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was found in Forma LMS up to version 4.1.43 in the UserselectorAdmController::getDataTask function. Manipulation of the Name argument causes SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch added a signature gate on the pt-paytium-user-data field but left a second filter, pt_cf_checkout_meta(), that copies $_POST['pt_form_field'] values without signature verification, allowing the user role to be overwritten and an administrator account to be created.

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107 in the loadCfg function. Manipulation leads to information disclosure. The attack can be launched remotely.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the iaUsers::authorize function. Manipulation of the $_SERVER['HTTP_REFERER'] argument causes open redirect. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the file /actions.json?action=assign-owner. Manipulation of the q argument leads to information disclosure. The attack can be executed remotely and the exploit has been released.

A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.14-rc1 in the MasterService::GetReplicaListByRegex function. Performing a manipulation leads to allocation of resources. The attack may be performed remotely and the exploit has been made public.

A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.13.post1/0.3.14-rc1 in the ScopedSegmentAccess::MountSegment function. Performing a manipulation results in improper access controls. The attack can be performed remotely and the exploit has been released.

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1 in the UnmountSegment function of the RPC Path Handler component. Manipulation of the client_id/segment_id arguments causes authorization bypass. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability in pmTicket Project-Management-Software up to version 078fa56a782490c5059a0814f84df27984f4d7e2. The setSync function in /ajax/add_project.php improperly handles the conn_settings argument, leading to SQL injection. The attack can be launched remotely.

A vulnerability was found in SEMCMS up to version 4.2 in the file /Edit/php/upload_json.php. Manipulation of the imgFile argument causes cross site scripting. The attack may be initiated remotely and the exploit has been published.

GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 contain an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration. Under certain conditions an authenticated user could execute arbitrary code on the GitLab server.