CVE Vulnerability Catalog

Incorrect access control in the getLanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain access-device policy and client state information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 allows unauthenticated attackers to obtain device identification details via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force a reboot via a crafted MQTT message.

Incorrect access control in the RebootSystem function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force an immediate reboot via a crafted POST request to /cgi-bin/cstecgi.cgi.

A vulnerability in BitChat for iOS version 1.15.0 allows a remote attacker to cause a denial of service (DoS) by sending an unauthenticated MESSAGE packet into the mesh gossip cache.

A Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before version 1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record.

The WordPress plugin (Spiffy Plugin) before version 5.0.9 is affected by Stored Cross-Site Scripting in the Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect users to a malicious site or control the account.

The WordPress plugin (Bit Assist) before version 1.7.2 is affected by Stored Cross-Site Scripting in the Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect users to a malicious site or control the account.

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

Contributor SQL Injection in WPBulky <= 1.2.2 versions.

The Forminator plugin in versions 1.57.1 and earlier contains an unauthenticated other vulnerability type. An attacker without authentication can exploit this flaw.

The Medical Practice Management System developed by Le-yan has a sensitive data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_files. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a.

Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for subscribers. Subscriber-level users can gain unauthorized access to administrative functions.