CVE Vulnerability Catalog

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability allowing authenticated users to read arbitrary files by supplying crafted filenames with traversal sequences to the export download endpoint. Attackers can escape the intended export directory and access files readable by the application process.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.

Vulnerability in Apache Camel Atmosphere Websocket component due to improper input validation of Exchange headers outside the Camel namespace (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType). An external attacker can supply the list header via HTTP and take over the producer's dispatch decision, potentially suppressing or redirecting notifications to a different client.

An improper authentication vulnerability was found in Apache Camel Platform HTTP Main. When neither jwtIssuer nor jwtAudience was configured, the server only checked token signature and expiry, completely skipping validation of iss and aud claims. Affects versions 4.8.0 through 4.21.x; fixed in 4.22.0.

A Relative Path Traversal vulnerability in Apache Camel Google Storage component allows writing files outside the configured download directory. The camel-google-storage consumer does not normalize paths or verify that the destination stays within the allowed folder when downloadFileName is set. An attacker able to influence object names in the consumed bucket can cause Camel to create or overwrite arbitrary files with the privileges of the Camel process.

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component allows writing files outside the configured directory during downloadBlobToFile operation. Blob names with parent-directory segments are not normalized, enabling overwriting arbitrary files with Camel process privileges.

A vulnerability in the Apache Camel Knative component allows an unauthenticated attacker to inject Camel-internal headers (e.g., CamelHttpUri, CamelHttpPath, CamelFileName) via a structured-mode CloudEvent request. This occurs because CloudEvent extension attributes are copied to Exchange headers without filtering, enabling override of configured values in routes forwarding messages to header-driven components such as camel-http or camel-file.

A relative path traversal vulnerability in the Apache Camel Azure-Storage Datalake component allows writing files outside the configured target directory during the downloadToFile operation. Remote file names with parent-directory segments are not normalized or checked, enabling creation or overwriting of files at arbitrary locations accessible to the Camel process.

Vulnerability in Apache Camel involves improper input validation in the camel-mail component. When MimeMultipart data format is configured with headersInline=true, MIME headers from the message are copied to Camel headers without filtering, allowing an attacker to inject headers from Camel's internal namespace and override component behavior.

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.

The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability.

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP).

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges.

Netis NC63 firmware up to V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.