CVE Vulnerability Catalog

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.

Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.

The system Binder accepts unverified AT commands, allowing local applications to read baseband files or disable cellular connectivity.

A vulnerability in the Supermicro BMC SMTP service on model AS-2115HS-TNR allows an attacker to gain administrator privileges and inject specially crafted characters into the SMTP configuration, potentially causing unintended command execution during process invocation.

System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.

The debugging routine SCREEN_CLICK(5053) allows bypassing the standard login screen and directly entering an interactive shell interface.

Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

In BOSH Director (all versions prior to v282.1.12), the ReleaseJob#unpack function builds job_dir and job_tgz paths using a name from the attacker-supplied release.MF file. These paths are interpolated into a shell command without proper escaping, allowing shell command injection via metacharacters in the name. An attacker can execute arbitrary commands in the context of BOSH Director.

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. A cached pointer into the entity-value SV could read from freed allocation after reallocation, potentially disclosing adjacent heap contents.

A vulnerability in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. The methods HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-code OpenSSL::SSL::VERIFY_NONE, enabling traffic interception between bosh-monitor and the BOSH director or UAA.

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every director call (/info, /deployments, /deployments/<name>/vms). Affected versions: BOSH all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later.

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password.

In BOSH (all versions prior to v282.1.12), the PackagePersister.validate_tgz function builds a shell command with a package name from the release.MF file without escaping. The Sequel validation (VALID_ID) runs after the shell command, so an attacker can inject shell commands via metacharacters in the package name.

The SP Project & Document Manager plugin for WordPress up to version 4.71 lacks a capability check in the view_file function. Unauthenticated attackers can read file metadata and obtain download links for arbitrary files in project folders, which may contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, allowing bypass of all controls.

A vulnerability was found in ealpha072 Student-Management-System in the admin/config.php file of the Administrative Backend component. The issue involves improper authentication, allowing remote attacks. The exploit is publicly available.