CVE Vulnerability Catalog

The TRENDnet TEW-432BRP router version 3.10B20 contains a stack-based buffer overflow in the formTcpipSetup function of /goform/formTcpipSetup. Manipulating the Name argument allows remote attack, and the exploit has been publicly disclosed.

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected devices do not properly restrict executable content contained in imported trace files. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. An authenticated remote attacker could access sensitive internal information.

The authorization middleware of the WMS MobileServer fails to require authentication in two cases: it only requires an Authorization header for GET and HEAD requests, and requests with a malformed or non-bearer Authorization header are passed through without a valid token being required. A remote attacker with network access can invoke API functionality without valid credentials.

The Wavlink WL-WN592AX6 router version 250422 contains a vulnerability in the system function of the wmapd daemon component. Manipulation of an argument leads to OS command injection, and the attack can be launched remotely.

The Wavlink WL-WN530BE1-A router version 251117 contains a stack-based buffer overflow in the strcpy function of /cgi-bin/ExportAllSettings.cgi in the Settings Export CGI component. Manipulating the HTTP_COOKIE/X-Cmd argument allows remote attack.

The Wavlink WL-WN530BE1-A router version 251117 contains a vulnerability in the popen function of /cgi-bin/uploadVpn.cgi. Manipulating the Type argument leads to OS command injection, and the attack can be performed remotely.

A flaw has been found in D-Link DCS-930L B1.08B4 affecting the mpfd_decode function in bootloader_region.bin of the Emergency HTTP Recovery Server component. Manipulating the firmware argument leads to improper verification of the cryptographic signature. The attack can be performed remotely and the exploit has been published.

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. Installation templates contain a default credential copied into the active configuration, and the installer and configuration script do not automatically replace it with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.

GitLab CE/EE versions from 19.2 to 19.2.8, 19.3 to 19.3.5, and 19.4 to 19.4.2 contain a vulnerability that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. The issue stems from insufficient validation of regular expressions in CI/CD configuration.

SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker controlling the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, leading to client credential exfiltration.

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could lead to full compromise of the remote system.

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the system.

SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code. Successful exploitation could allow the attacker to execute arbitrary ABAP code in the system.

Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. The update (PUT) and delete (DELETE) handlers for /api/v1/credentials omit the authentication call, unlike other routes. Any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential without authentication. All published versions through 6.5.4 are affected; fixed in 6.5.5 by adding authentication.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability due to improper validation of pathnames. A remote authenticated attacker can exploit this to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to an unauthorized actor. A remote authenticated attacker can exploit this to obtain confidential data.