CVE Vulnerability Catalog

The MBStorage DRAM lighting control module in Gigabyte Control Center (GCC) has an Improper Access Control vulnerability. An authenticated local attacker can send specific IOCTL commands via the MyPortIO_x64.sys driver, allowing arbitrary read/write of physical memory and kernel-level privilege escalation.

An integer overflow vulnerability in an unspecified component allows an attacker to achieve system-level access to the affected software.

A SQL injection vulnerability has been discovered in Jinher OA 1.0 in the file PlanGiveOut.aspx. An attacker can remotely manipulate the httpOID argument, leading to SQL injection. The exploit has been published and may be used.

A vulnerability was found in the QMUDisk driver (qmudisk64.sys) of Tencent PC Manager 18.1.30242.301, involving an uncontrolled search path. The attack requires local access and is considered difficult due to high complexity. The exploit has been publicly disclosed.

A SQL injection vulnerability has been identified in Metasoft MetaCRM up to version 6.4.0 Beta06 within the PHPRPC Remote Call Interface component. The flaw exists in the file /customizemt/xkq/rpc.jsp, where the RPCService.query function improperly handles the phprpc_args argument. The attack can be executed remotely, and a public exploit is available.

A heap-based buffer overflow vulnerability has been found in the saappctl.sys library of the SecureAge CatchPulse driver up to version 10.9.3. The attack requires local access and the exploit has been publicly disclosed.

A use-after-free vulnerability was found in Zephyr's dynamic kernel-object tracking mechanism. In SMP configurations with userspace and dynamic objects enabled, unsynchronized operations on a doubly-linked list can lead to kernel memory corruption.

A stack buffer overflow vulnerability exists in the parse_ipv4() function in Zephyr OS. An attacker can craft an IP address with a long suffix after the colon, causing data to be copied beyond the allocated 17-byte buffer. The issue has been present since v1.9.0 through v4.4.0 and can lead to system crashes or potential control-flow hijack.

In Zephyr's WireGuard subsystem, wg_process_data_message() linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The net_buf_linearize() call passes the attacker-derived data_len as both destination capacity and copy length, bypassing the function's internal bound. When data_len exceeds CONFIG_WIREGUARD_BUF_LEN, an out-of-bounds write (CWE-787) occurs.

A vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network via untrusted pointer dereference.

The vulnerability in LuCI is due to improper encoding of DHCPv6 lease hostnames before rendering in status tables. This allows adjacent network attackers to inject HTML markup by sending a DHCPv6 Client FQDN containing script tags.

A stored cross-site scripting (XSS) vulnerability in luci-app-upnp allows unauthenticated LAN clients to inject malicious JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which is stored by miniupnpd and rendered without output encoding by luci-app-upnp, executing the payload when administrators view the UPnP or Status pages.

A vulnerability in OpenWrt luci-app-samba4 allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.

A vulnerability in Capgo before version 12.128.2 allows enterprise administrators to delete password identities of users in foreign organizations via the SSO prelink endpoint. Attackers with org.update_settings permission and an active SSO provider can permanently remove email-based authentication for any user matching the provider's email domain, forcing victims to use the attacker's SSO provider or complete password reset recovery.

A vulnerability in Capgo before version 12.128.2 allows changing the account email address without requiring current password re-authentication or verification of the existing email address. An attacker with a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

Crawl4AI before version 0.8.8 has a credential exfiltration vulnerability via unauthenticated Docker API endpoints. Attackers can redirect LLM API calls to attacker-controlled servers and read environment variables, including API keys and JWT secrets.

In Capgo before version 12.128.2, a privilege escalation vulnerability exists where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to the stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read sensitive financial and operational metrics via the Supabase PostgREST global_stats endpoint. Using only the public API key, attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

A SQL injection vulnerability was found in the login component of SmartHomeAdatum up to commit cf495353d81b680675eb8d9aa14a318aa45ce12c. An attacker can remotely manipulate the 'Login' argument in users.php, leading to unauthorized database access. The product uses rolling releases, so no specific version numbers are available.

A remote code injection vulnerability was found in SonicCloudOrg sonic-agent up to version 2.7.2 within the JWT Authentication Filter component. The flaw resides in ExchangeController.java and can be exploited remotely. The exploit is publicly disclosed and the product is no longer supported.