CVE Vulnerability Catalog

In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.

Command injection in the nslookup function in /cgi-bin/luci/api/diagnose of Ruijie EG105G-P router. Manipulation of the params.target argument allows remote arbitrary command execution.

Vulnerability in the RevoDetector.sys driver of VS Revo RevoUninstaller 2.5.x/2.6.x allows a local attacker to trigger a heap-based buffer overflow via the IOCtl_Handler function. Exploit is publicly available.

A buffer overflow vulnerability has been found in the web server component of GALAYOU Y4 version 1.0.0. The attack is only possible from the local network. The exploit is publicly available and the vendor did not respond.

Vulnerability in Comma AI Openpilot 0.11 allows a local attacker to deserialize untrusted data via pickle.load/pickle.loads in modeld.py. This could lead to arbitrary code execution.

In GL.iNet GL-MT3000 up to version 4.4.5, a command injection vulnerability exists in the file /usr/bin/one_click_upgrade of the Online Firmware Upgrade Handler. The attack can be launched remotely. A public exploit is available.

In GL.iNet GL-MT3000 up to version 4.4.5, a command injection vulnerability exists in the replace_country function of the Tor Proxy Service Configuration Handler. The attack can be initiated remotely. A public exploit is available.

The driftregion iso14227 library (through 0.9.0) contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14227.c, allowing a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.

LiamBindle MQTT-C versions prior to 1.1.7 contain a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response() function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker, or capable of injecting MQTT traffic into an unencrypted session, can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.

Off-by-one buffer overflow vulnerability in nanoMODBUS through v1.23.0 in the recv_msg_header function of the Modbus/TCP server. A remote unauthenticated attacker can write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame with the Length field set to 255.

Config::IniFiles for Perl before 3.001000 uses a two-argument open() for the -file argument, allowing OS command injection or file overwrite if the filename starts or ends with a pipe (|) or redirect (>).

A vulnerability in D-Link DCS-935L 1.10.01 affects the snprintf function in the file /web/cgi-bin/greece/rhea of the HTTP Handler component. Manipulation of the data argument leads to a format string vulnerability. The attack can be launched remotely, and the exploit has been publicly disclosed.

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

The Bookly plugin for WordPress up to version 27.2 contains a Stored XSS vulnerability in the 'bookly-customer-full-name' cookie. An unauthenticated attacker can inject scripts that execute when an administrator visits an infected page. Requires the 'Remember personal information in cookies' setting to be enabled (disabled by default).

The GPTranslate plugin for WordPress up to version 2.31 contains a stored XSS vulnerability via the REST API. An unauthenticated attacker can inject scripts that execute when a user visits a page. The API key is exposed in the HTML source of every page.

A path traversal and privilege escalation vulnerability was found in the Grafana Operator. It allows a malicious user who can create Dashboard or LibraryPanel resources to obtain the Kubernetes service account token of the operator manager.

The WP Ticket plugin for WordPress up to version 6.0.4 is vulnerable to SQL Injection via the `s` search parameter. An unauthenticated attacker can append additional SQL queries to existing queries, allowing extraction of sensitive database information.

Vulnerability in ABRT event handler scripts in the libreport library allows arbitrary file overwrites on the system. Scripts write data to files without the O_NOFOLLOW flag, allowing a root process to follow symbolic links.

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. It allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.