CVE Vulnerability Catalog

Johnson Controls Metasys 14 and 15 contain a cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation. Affected versions: Metasys 14 before 14.1.5; Metasys 15 before 15.0.1.

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

A vulnerability in the Hearing Access Service (HAS) in Zephyr RTOS allows a remote (Bluetooth) crash of the HAS peripheral. The issue occurs when a previously bonded client reconnects during the startup window before the application registers the service, leading to an assertion or NULL pointer dereference.

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on image dimensions and number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

A vulnerability in the Apache Camel Undertow component stems from improper input validation. The default UndertowEndpoint configuration overwrites the UndertowHeaderFilterStrategy, so specific filters (including the websocket. prefix) are not applied on endpoint-configured routes. An attacker could exploit this to redirect WebSocket messages to a different peer or smuggle disallowed headers.

rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level access because the registration controller does not assign a role and the users.role column defaults to Admin, enabling access to stored device credentials, user data, and API token issuance.

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability allowing authenticated users to read arbitrary files by supplying crafted filenames with traversal sequences to the export download endpoint. Attackers can escape the intended export directory and access files readable by the application process.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.

Vulnerability in Apache Camel Atmosphere Websocket component due to improper input validation of Exchange headers outside the Camel namespace (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType). An external attacker can supply the list header via HTTP and take over the producer's dispatch decision, potentially suppressing or redirecting notifications to a different client.

An improper authentication vulnerability was found in Apache Camel Platform HTTP Main. When neither jwtIssuer nor jwtAudience was configured, the server only checked token signature and expiry, completely skipping validation of iss and aud claims. Affects versions 4.8.0 through 4.21.x; fixed in 4.22.0.

A Relative Path Traversal vulnerability in Apache Camel Google Storage component allows writing files outside the configured download directory. The camel-google-storage consumer does not normalize paths or verify that the destination stays within the allowed folder when downloadFileName is set. An attacker able to influence object names in the consumed bucket can cause Camel to create or overwrite arbitrary files with the privileges of the Camel process.

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component allows writing files outside the configured directory during downloadBlobToFile operation. Blob names with parent-directory segments are not normalized, enabling overwriting arbitrary files with Camel process privileges.

A vulnerability in the Apache Camel Knative component allows an unauthenticated attacker to inject Camel-internal headers (e.g., CamelHttpUri, CamelHttpPath, CamelFileName) via a structured-mode CloudEvent request. This occurs because CloudEvent extension attributes are copied to Exchange headers without filtering, enabling override of configured values in routes forwarding messages to header-driven components such as camel-http or camel-file.

A relative path traversal vulnerability in the Apache Camel Azure-Storage Datalake component allows writing files outside the configured target directory during the downloadToFile operation. Remote file names with parent-directory segments are not normalized or checked, enabling creation or overwriting of files at arbitrary locations accessible to the Camel process.

Vulnerability in Apache Camel involves improper input validation in the camel-mail component. When MimeMultipart data format is configured with headersInline=true, MIME headers from the message are copied to Camel headers without filtering, allowing an attacker to inject headers from Camel's internal namespace and override component behavior.

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.