CVE Vulnerability Catalog

TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the staticInfoSend function. Unauthenticated attackers can trigger static information reporting to the configured master by sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via a crafted MQTT message to the cs_broker component.

Incorrect access control in the updatePriChannel function of TOTOLINK T6 allows unauthenticated attackers to rescan and switch the primary mesh channel via a crafted MQTT message to the cs_broker component.

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 allows unauthenticated attackers to update stored slave inventory records via a crafted MQTT message to the cs_broker component.

An Arbitrary File Upload vulnerability in the Gravity Forms plugin for WordPress (up to and including 3.0.2). Insufficient validation of multi-file upload chunk state in GFAsyncUpload::upload() allows unauthenticated attackers, when a public form has a File Upload field with Multiple Files enabled, to upload a PNG/PDF polyglot to an attacker-selected public .php or .html filename in the temporary upload directory. This can lead to remote code execution on NGINX or other non-.htaccess respecting servers. Where PHP execution is blocked, attacker-written HTML can result in stored XSS.

Improper Control of Generation of Code ('Code Injection') vulnerability in KIO (Klemsan Internet Objects) allows code injection. Affects versions before v1.9.

Improper neutralization of special elements in an SQL command ('SQL injection') vulnerability in Products's Store allows SQL injection. Affects versions before 030631b2.

A privilege escalation vulnerability in FactoryTalk Activation Manager. Custom installer actions spawn visible console windows running with SYSTEM privileges during installation or repair. An authenticated attacker with Windows credentials could hijack these windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources.

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled.

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.

An OS Command Injection vulnerability (CWE-78) that could cause execution of Linux operating system commands when a system backup that has been maliciously modified is restored.

A security issue in ControlFLASH where the installer grants write permissions to the 'Everyone' group on a product installation directory. This could allow arbitrary code execution, giving an attacker the ability to run any commands or code of their choice on a target machine at the logged-in user's permission level.

A denial-of-service vulnerability in FactoryTalk® Historian Machine Edition. An authenticated network-adjacent attacker can send crafted requests to the web interface, causing buffer overflow conditions that may crash the device and make it unresponsive.

A security issue exists in FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device.

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files, leading to denial of service.

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent.

A denial-of-service security issue exists in the affected product. The issue stems from a crafted CIP packet crashing the module, requiring a restart to recover.

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated attacker could retrieve repository metadata and files, potentially reconstructing the application's source code.

This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated attacker could manipulate parameters, leading to exposure of sensitive information of other users.

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated attacker could upload arbitrary files to a web accessible directory, potentially executing arbitrary code and compromising the system.