CVE Vulnerability Catalog

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to overwrite the saved return address by sending a POST request with a Content-Length header exceeding 512 bytes.

IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant.

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container.

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

n8n is a workflow automation platform that prior to versions 1.123.32, 2.17.4, and 2.18.1 had a flaw in the xml2js library allowing prototype pollution via a crafted XML payload. An authenticated user with the right permissions could exploit this to achieve remote code execution on the n8n host.

In the n8n workflow automation platform, the SeaTable node's row:search and row:get operations concatenated user-controlled input directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic. The issue was patched in versions 1.123.32, 2.17.4, and 2.18.1.

n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authenticated caller was authorized to use a supplied credential reference. This allowed an attacker to use another user's credentials for authentication against attacker-controlled infrastructure.

Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.

Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.

Wersja 2.10 i wcześniejsze OpenSTAManager zawierają podatność na nieautoryzowane przesyłanie plików w funkcjonalności aktualizacji modułów (modules/aggiornamenti/upload_modules.php).

The Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class. The hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation, allowing unauthenticated attackers to execute unbounded loops.

Detect-It-Easy w wersjach przed 3.21 zawiera podatność na traversję ścieżek, która umożliwia atakującym zapis dowolnych plików w systemie plików poprzez stworzenie złośliwych wpisów archiwum z relatywnymi sekwencjami traversji lub absolutnymi ścieżkami. Atakujący mogą wykorzystać niewystarczającą normalizację ścieżek podczas ekstrakcji archiwum, aby zapisać pliki poza zamierzonym katalogiem ekstrakcji.

OpenC3 COSMOS prior to versions 6.10.5 and 7.0.0-rc3 allowed users to change their password without providing the old password, accepting only a valid session token. This behavior can be exploited by an attacker who has a valid session token to hijack accounts and block legitimate users from accessing their accounts.

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records.

An integer underflow vulnerability exists in FRRouting (FRR) versions stable/10.0 through stable/10.6. Attackers can cause a Denial of Service (DoS) by sending a crafted BGP UPDATE message.

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality. Attackers can exploit this flaw by supplying 'test' as the hash parameter, allowing access to sensitive order details.

BusyBox before commit 42202bf has a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler. A network-adjacent attacker can send a crafted DHCPv6 response with a malformed D6_OPT_DNS_SERVERS option to trigger memory corruption.

In the adbd_tls_verify_cert function of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote code execution as the shell user with no additional execution privileges needed.

In Apache OpenNLP before versions 1.9.5, 2.5.9, and 3.0.0-M3, a denial-of-service vulnerability exists due to unbounded array allocation in AbstractModelReader. The methods getOutcomes(), getOutcomePatterns(), and getPredicates() allocate arrays based on a 32-bit integer from the model file without validation, allowing an attacker to set the value to Integer.MAX_VALUE and trigger an OutOfMemoryError.

D-Link DIR-605L Hardware Revision A1 contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot with the username 'Alphanetworks' and the static password 'wrgn35_dlwbr_dir605l'.