CVE Vulnerability Catalog

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling caused by improper parsing of the HTTP transfer-encoding request header. An attacker could send a specially crafted header to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.2.0, affecting the checkShellCommand function in src/capabilities/permissions.ts. Manipulation leads to incorrect privilege assignment, and the attack can be initiated remotely. The exploit has been publicly disclosed.

In cosmicstack-labs mercury-agent up to 1.2.0, the PermissionManager.checkShellCommand function in mercury-agent/src/capabilities/permissions.ts (Shell Permission Manifest component) can lead to information disclosure via manipulation. The attack is restricted to local execution and the exploit is publicly available.

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.13, affecting the PermissionManager.checkShellCommand function in mercury-agent/src/capabilities/permissions.ts. Manipulation leads to improper authorization, and the attack can be initiated remotely. The exploit has been publicly disclosed.

A vulnerability was identified in HKUDS nanobot up to 0.2.1 in the functions ExecTool._guard_command and ExecTool._spawn of the file nanobot/agent/tools/shell.py (ExecTool component). The manipulation leads to argument injection and can be triggered remotely.

A vulnerability was found in HKUDS nanobot up to 0.2.1, affecting the ExecTool._guard_command and ExecTool._spawn functions in nanobot/agent/tools/shell.py. The manipulation causes an incomplete blacklist, allowing remote attacks. A patch is available with name af582246f141311d574551b7571a517bcc3df750.

The ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints. Unauthenticated attackers can access and manipulate protected resources, including retrieving offers, deleting them, and viewing statistics that disclose bidder contact information and business data.

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction. An attacker can write files outside the container root by supplying a crafted image with symlinks pointing to arbitrary paths. Via /container/add, this allows root-privileged file creation, directory creation, file deletion via overlayfs whiteout, and hardlink creation on the persistent data partition without starting the container. The 7.23.x long-term branch does not contain the fix.

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function, allowing authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command.

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, obtaining unintended temporary elevated access to AWS accounts.

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler.

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py. The output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file with a BaseFont name containing encoded path separators that decode to ../ sequences or absolute paths, causing arbitrary file writes outside the intended output directory.

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.

In ESPHome Device Builder Dashboard prior to version 1.0.12, authentication environment variables were renamed from $USERNAME/$PASSWORD to $ESPHOME_USERNAME/$ESPHOME_PASSWORD with no fallback. As a result, instances protected with the old names lost authentication after upgrade and the dashboard became open to anyone who could reach its port. The issue is fixed in 1.0.12, which restores the old names as a deprecated fallback with a startup warning.

IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but only if the profile could already do that by itself.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.

In Zephyr OS, the net_if_ipv6_calc_reachable_time() function in subsys/net/ip/net_if.c incorrectly calculates the neighbor reachable time when base_reachable_time is 1, resulting in a value of 0. An attacker can send an unauthenticated Router Advertisement with the Reachable Time field set to 1, causing the reachable time to be zeroed. Consequently, when a neighbor is confirmed reachable, a kernel assertion may occur (if CONFIG_ASSERT is enabled) or the timer fires immediately, leading to constant re-solicitation and degradation of Neighbor Discovery.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It was assigned for an old issue in the brltty daemon and was never fully published.