CVE Vulnerability Catalog

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.

SSRF vulnerability in Apache Hive before 4.2.1 allows an authenticated attacker with CREATE TABLE privilege to force the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url property for an Avro table. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity.

SQL injection vulnerability in Apache Hive before 4.2.1 affects partition-name resolution in Hive Metastore when direct SQL is enabled. An authenticated user can craft partition names in RPC requests to alter the WHERE clause, allowing read, modification, or impact on metadata of unintended partitions (e.g., statistics updates, truncate targets, file-metadata cache operations).

The extension fails to safely process untrusted client input from an attacker-controlled cookie directly into PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using those credentials to alter the identification number.

The OCPP 1.6 client contains a stack buffer overflow in parse_getconfig_msg(). An attacker controlling the central system or performing a man-in-the-middle attack can send a GetConfiguration request with a key longer than 50 bytes, causing a stack overflow in the reader thread.

NLTK before 3.10.0 contains an unsafe pickle deserialization vulnerability in TransitionParser.parse(). Deserialization uses default restricted=False, allowing arbitrary Python code execution when loading a crafted model file.

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, potentially turning dormant quoted values into active directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live after any GitPython config write, enabling arbitrary code execution.

Grav Login plugin before 1.0.16 fails to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts.

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution.

Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.

Unauthenticated PHP Object Injection in The Events Calendar versions up to 6.17.2.

Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.

A vulnerability in CakePHP Authentication plugin (versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0) allows authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. Fixed in versions 2.11.2, 3.3.7, and 4.2.1.

Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63.

A vulnerability in UltimateAI versions up to 3.1.0 allows a subscriber to upload arbitrary files to the server.

A vulnerability in Boost versions up to 2.0.4 allows unauthenticated SQL injection.