CVE Vulnerability Catalog

Insufficient state checks allow bypassing two-factor authentication (2FA) verification.

libsolv has a heap buffer overflow vulnerability during decompression of attacker-controlled compressed data in .solv files due to insufficient input validation. A crafted .solv file can lead to out-of-bounds memory access, potentially causing information disclosure, program execution alteration, or denial of service.

FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function fails to call set_verify_mode(verify_peer), so OpenSSL does not validate the server's certificate chain. This function is used for telemetry reporting, sending system information.

In FastNetMon Community Edition up to 1.2.9, an integer overflow in the packet capture buffer allocation function allocate_buffer() leads to a smaller-than-expected buffer and subsequent heap corruption via out-of-bounds writes.

Algernon before version 1.17.8, when started with --domain (or --letsencrypt), resolves the served directory by joining the configured --dir with the client-supplied Host header without validation, allowing attackers to read arbitrary files, list directories, and execute server-side Lua code.

In Algernon before 1.17.7, when invoked with a single file, debug mode exposes the full path and contents of the source file in error responses. Any client can trigger an error and obtain the source code.

Twenty CRM versions 1.18.0 and earlier do not set Content-Type, Content-Disposition, or X-Content-Type-Options headers when serving files. This allows an authenticated attacker to upload an HTML file with JavaScript that executes in the context of the Twenty CRM domain when accessed.

In MikroORM before @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, the identifier-quoting functions and JSON-path emitters do not properly escape special characters. An application passing attacker-controlled data to public ORM APIs can lead to SQL injection.

Algernon before version 1.17.6 contains a vulnerability in the uploadedFileSaveIn() function in lua/upload/upload.go, which uses filepath.Join() with a caller-supplied directory without boundary checking after joining, allowing file writes outside the server's document root.

Algernon, a small self-contained pure-Go web server, prior to version 1.17.6, has a vulnerability in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is not goroutine-safe, concurrent requests race on the shared state, causing Lua VM corruption.

Improper validation of the search parameter in the com_media files API endpoint leads to a path traversal vulnerability.

NVIDIA Isaac Launchable for Linux has a vulnerability where sensitive information is transmitted in clear text. Successful exploitation could lead to code execution, privilege escalation, information disclosure, and data tampering.

Vulnerability in NVIDIA Transformers4Rec for Linux allows improper deserialization of untrusted data. Successful exploitation may lead to code execution, data tampering, and information disclosure.

FastNetMon Community Edition up to 1.2.9 exposes an unauthenticated gRPC API on port 50052. An attacker with network access can ban IPs, unban attacks, and execute external scripts.

FastNetMon Community Edition up to version 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The decode_mp_reach_ipv6() function does not validate data before use, allowing an attacker to control field lengths and trigger out-of-bounds reads.

In e107 before 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to generate password reset links pointing to attacker-controlled domains.

The deployment of Genetec RabbitMQ has a high-severity vulnerability that allows a privilege escalation attack.

A security flaw has been discovered in Das Parking Management System 6.2.0. This vulnerability affects unknown code of the component Search API Endpoint. The manipulation of the argument Value results in SQL injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.

A SQL injection vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0 in the xp_cmdshell function of the ParkingRecord/ExportParkingRecords file within the API endpoint. Manipulation of the Value argument allows remote attack execution. The exploit is publicly available and may be used.

A path traversal vulnerability in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 allows remote manipulation of the path argument in /SubstationWEBV2/app/..;/main/upfile, leading to arbitrary file read. Exploit is publicly available.