CVE Vulnerability Catalog

Server-side request forgery (SSRF) vulnerability in the /har/test endpoint in QD. Fetcher.build_request() constructs an HTTP request from user-supplied data without validating URL scheme, host, or IP range, and the endpoint does not require authentication.

HCL Connections is vulnerable to information disclosure, which could allow a user to obtain data they are not entitled to, caused by improper handling of request data.

The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (part of WP Legal Pages) has an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files. This issue affects versions from n/a through 4.4.1.

A vulnerability was detected in NASA earthdata-search 1.0.0 in the scaleImage function. Manipulation results in server-side request forgery (SSRF). The attack can be initiated remotely, and the exploit is public.

An OS command injection vulnerability was found in Edimax BR-6214K 1.40 in the system function of www/ping.asp (asp_setPing Endpoint). Manipulating the pingstr argument allows remote command execution. The exploit is public and the vendor did not respond.

A vulnerability was identified in Edimax BR-6214K 1.40 in the system function of www/wlanMP.asp. Manipulation of the ateFunc argument leads to OS command injection, allowing remote attacks. The exploit is publicly available.

A SQL injection vulnerability was found in code-projects Online Shopping System 1.0 in the search functionality. Manipulation of the keyword argument allows remote attack. The exploit has been publicly disclosed.

In the zbus_polkit crate before 5.1.0, Subject::new_for_owner() encodes the uid as unsigned 32-bit, while the polkit interface expects signed 32-bit. This mismatch causes polkit to ignore the supplied UID and determine the owner itself via PID, leading to a TOCTOU race. A local attacker can exploit this to bypass polkit authorization and perform unauthorized actions.

The ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability. Attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler, achieving PHP code execution as the web-server user.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

An OS command injection vulnerability in the eObčanka-Identifikace application (DIA) on MacOS allows an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.

Incorrect access control in the setIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to alter IPTV service configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 allows unauthenticated attackers to expose internal services via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 allows unauthenticated attackers to alter dynamic DNS state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to add or change static DHCP rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to weaken edge filtering via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to establish or weaken guest wireless access via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUploadSetting function of TOTOLINK T6 allows unauthenticated attackers to manipulate the upload or flash workflow via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWanCfg function of TOTOLINK T6 allows unauthenticated attackers to alter WAN configuration and connectivity via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via a crafted POST request to /cgi-bin/cstecgi.cgi.