CVE Vulnerability Catalog

Trueview T18161 S 6.0.23.4 contains improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components.

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component.

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components.

SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component.

nebula-mesh from version 0.6.0 to before 0.7.2 allows non-admin operators (role user) to set allow_private: true on their own managed webhook subscriptions (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard, letting a low-privilege operator make the server request internal addresses.

nebula-mesh prior to version 0.7.1 has a vulnerability where revocation is the only in-band mechanism to isolate a compromised host. Because the blocklist never reaches any peer's config.yml, a blocked host retains full overlay reachability to every peer under its CA for up to 30 days (agent) / 365 days (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host.

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.

laravel-backup-restore prior to version 1.9.4 allows OS command injection during database restore from a crafted backup archive. An attacker can exploit this by providing a malicious archive.

nebula-mesh prior to version 0.3.8 has a vulnerability in the web handler renderMobileBundle that passes the real *pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a *pki.CAManager, but Build never calls CAManager.Wipe() on any return path. As a result, when a mobile-bundle request goes through the web UI and Build returns (especially on error), the plaintext CA private key remains on the Go heap, unwiped, until garbage collection. An attacker able to read process memory can recover the CA signing key, allowing minting arbitrary host certificates for the mesh.

nebula-mesh prior to version 0.3.8 stores operator session tokens in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication.

nebula-mesh before version 0.3.7 has two authorization gaps: the blocklist is not checked at certificate sign/re-enroll time (it is keyed by fingerprint, so re-enrollment creates a new fingerprint), and renewal does not re-validate operator or CA status. A host that should no longer be trusted can obtain a fresh valid Nebula certificate.

Amazon EFS CSI Driver before v3.4.1 has a vulnerability in the volume deletion component where unverified ownership of a storage access point might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.

A security vulnerability has been detected in jofpin trape 2.0. It affects unknown code in core/user.py of the Telemetry Endpoint component. Manipulation of the vId argument leads to a race condition. The attack can be executed remotely. Attacks of this nature are highly complex. Exploitability is stated as difficult. The exploit has been disclosed publicly and may be used. The project was informed early through an issue report but has not responded yet.

jofpin trape 2.0 has a weakness in the file core/user.py where manipulation of the argument vId/id causes authorization bypass. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The project was informed but has not responded yet.

In jofpin trape 1.0.0/2.0, the join_room function in core/sockets.py of the Admin Endpoint component lacks authentication. The attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.

A vulnerability in the DirectIo64.sys driver of PassMark products (PerformanceTest, BurnInTest, OSForensics) before specified versions allows an unprivileged local user to read all physical memory via a single IOCTL without caller identity check. The handler writes a crash-dump-format image of physical memory to a caller-supplied file path in SYSTEM context, enabling file creation in restricted locations and recovery of other processes' memory. The header exposes kernel module list, process list, and PFN pointers defeating KASLR, and a missing NULL check on an internal locator can cause a kernel crash.