CVE Vulnerability Catalog

A vulnerability in Opcenter X (versions prior to V2604) stems from improper validation of the algorithm in the JWT header. An unauthenticated remote attacker can forge arbitrary JWT tokens, bypass authentication, and impersonate any user, including administrative accounts.

A vulnerability in the Management Server API of XProtect allows users with edit permissions to execute arbitrary code in the context of the Management Server Service.

In DBI::SQL::Nano for Perl versions 1.42 through 1.651, the <= and >= SQL operators are inverted for text comparisons. The <= operator is incorrectly evaluated as 'greater than or equal', and >= as 'less than or equal', causing incorrect WHERE clause filtering.

An insufficient technical documentation vulnerability in Apache Tomcat fails to clearly document the requirements for securely configuring the EncryptInterceptor. This affects multiple Tomcat versions from 7.0.100 through 11.0.23.

A vulnerability in Apache Tomcat's rewrite valve allows security constraint bypass due to improper handling of URL hex encoding. Affected versions include 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0-M1 through 9.0.119, and 8.5.0 through 8.5.100.

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using MongoDB backend are vulnerable to unauthenticated arbitrary file write via the AAS thumbnail API. An attacker can upload a file with a controlled filename and then trigger retrieval, writing the content to any path on the server filesystem.

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) prior to version 3.2.1 allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. Exploitation can occur via crafted OAuth token request URLs, malicious files in ingestion pipelines, SQL injection via staging options in shared Spark environments, or runtime SET commands in shared Spark-SQL sessions.

The Word Count and Social Shares WordPress plugin through version 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks. This allows any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g., by deleting wp-config.php).

SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.

An authenticated attacker can exploit logical errors in memory management in SAP NetWeaver Application Server ABAP, causing memory corruption. This could lead to unauthorized data access, modification, or system unavailability.

An HTTP Request Smuggling vulnerability in SAP Approuter allows an unauthenticated attacker to send a crafted HTTP request, causing request-response desynchronization. This can expose user responses and make the system unavailable, with high impact on confidentiality and availability.

A vulnerability in the Crypt::OpenSSL::X509 library for Perl before version 2.1.3 allows a heap out-of-bounds read via a long certificate extension OID. Functions like extensions(), extensions_by_long_name(), extensions_by_oid(), and has_extension_oid() incorrectly use the full OID text length as the hash key length, causing a read past the fixed-size 129-byte buffer.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.

9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.

A vulnerability in D-Link DIR-1253 version 1.0.1.250923.142435 allows privilege escalation via the etc/shadow file. An attacker can exploit this flaw to gain unauthorized access to user accounts.

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint.

An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.

An out-of-bounds read vulnerability was found in EIPStackGroup OpENer version 2.3.0 (commit 76b95cf) in the Connection Manager handling of ForwardOpen requests. The issue occurs when processing short malformed packets, where the parser continues reading fields even when request data is insufficient.