CVE Vulnerability Catalog

Lumiverse before version 0.9.7 contains a command injection vulnerability in the SMB path handling function. When the primary toSmbPath method fails, the code uses an unvalidated basename in the smbclient script, allowing arbitrary command execution via injection of ';' separator or '!cmd' local escape.

Vulnerability in Lumiverse – the Spindle extension build pipeline runs `bun install` without `--ignore-scripts`, allowing a malicious extension to execute host-level code before security scanning. Fixed in version 0.9.7.

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class. Five methods use an incorrect bounds check, allowing writing exactly one byte past the end of the heap-allocated buffer. An attacker sending network traffic (NetFlow, sFlow, IPFIX, or BGP) can trigger this overflow, potentially achieving arbitrary code execution.

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service and potential remote code execution due to improper input validation.

A remote code execution vulnerability in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty (versions 8.5, 9.0) allows an attacker to execute arbitrary code via a specially crafted request.

In Eppendorf BioFlo 320, a vulnerability exists due to a hard-coded password in the VNC server. A remote attacker knowing the network address can gain full control of the user interface.

Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.

Critical Remote Code Execution (RCE) vulnerability in Twenty CRM (versions 1.7.7 through 1.16.7) via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. An authenticated attacker can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint.

In FACTION prior to 1.8.3, AccessControlInterceptor unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system.

Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.

The password and username reset features created plain HTTP links for HTTPS connections if the "Force SSL" flag wasn't explicitly set.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check in the com_users batch task allows privilege escalation.

Integer overflow in FastNetMon Community Edition up to 1.2.9 in the BGP AS_PATH attribute encoder leads to a heap buffer overflow.

Algernon before version 1.17.7 has a vulnerability in the DirPage function that, when a directory without an index file is requested, searches parent directories (past the configured server root) for a handler.lua file. The found file is executed with full access to the Algernon API, allowing unauthenticated remote code execution.

A vulnerability due to improper validation of user-supplied input leads to local file inclusion.

Improper access check in the com_config webservice component allows unauthorized access to endpoints.

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.