CVE Vulnerability Catalog

Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.

In Karakeep before 0.32.0, an SSRF protection bypass was identified via crafted HTTP redirects. An authenticated user can initiate requests to internal Docker services.

OpenKM version 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

Vulnerability in gix-submodule (before 0.29.0), gitoxide (before 0.5.21), and gix (before 0.84.0) allows bypassing the CommandForbiddenInModulesConfiguration guard. An attacker can inject arbitrary shell commands via the update field in .gitmodules, executed when Submodule::update() is called on a previously initialized submodule.

In FreeRDP before version 3.26.0, a heap-buffer-overflow vulnerability in gdi_CacheToSurface allows remote attackers to write out-of-bounds heap memory. Rectangle validation clamps coordinates to UINT16_MAX but copy operations use unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

Shenzhen Sixun Shanghui Group Business Management System version 10 has an SQL injection vulnerability in the /api/Dinner/PayConfig file via the tableno parameter. The attack can be performed remotely and the exploit is publicly available.

When the Identity Awareness blade is enabled with Browser-Based Authentication on the Security Gateway, an unauthenticated user may be able to read certain internal files on the gateway.

The Security Gateway incorrectly validates a length value in IKE packets when NAT-T is used (port 4500/UDP). A specially crafted packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service.

The VPN service mishandles an unexpected IKE fragment value on port 500/UDP during early connection setup, causing the service to terminate unexpectedly and temporarily disrupting VPN functionality.

An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by an unauthenticated network-based attacker to permanently prevent legitimate users from interacting with the service.

A PHP Remote File Inclusion vulnerability in Magentech SW Core (versions up to 1.7.18) allows PHP Local File Inclusion due to improper control of filename in include/require statements.

A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version 26.01). A specially crafted media file containing ID3v2 tags can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash.

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition to replace verified files with malicious ones before installation, resulting in local privilege escalation.

The affected product creates a directory with insecure default permissions during administrative installation. A low-privileged local attacker can modify a temporary file defining components to be installed, enabling local privilege escalation by forcing deployment of arbitrary components.

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Access control bypass vulnerability in the @koa/router package from version 14.0.0 before 15.0.0. When the router prefix contains path parameters, middleware is silently dropped from the execution chain, potentially allowing an attacker to bypass authentication, authorization, rate limiting, or input sanitization.