CVE Vulnerability Catalog

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with the schedule_search capability could run arbitrary SPL commands with the highest system privilege and read every credential stored in the credential store. This is possible because scheduled search alert action configuration does not properly restrict user-specific alert action settings before the search scheduler runs alert actions.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. The XSS is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The attack requires phishing the victim.

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user without the admin or power roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the stored access token. This is possible because the app's REST API endpoint handlers do not enforce the read_o11y_content capability before forwarding requests. The vulnerability does not affect versions 9.4 and 9.3.

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

TinaCMS before version 2.5.2 has a vulnerability in the Vite dev server where the server does not reject requests from disallowed origins and still routes POST /media/upload/* to the media handler. A remote attacker can cause a developer's browser to submit a state-changing request, allowing attacker-controlled content to be written inside the media root.

TinaCMS production media adapters (next-tinacms-s3, next-tinacms-dos, next-tinacms-azure, next-tinacms-cloudinary) before specified versions do not enforce the configured mediaRoot on upload/delete operations. An authenticated CMS editor can create or delete objects anywhere the storage credential can reach, including other tenants' or non-media objects.

IBM System Storage DS8A00 and DS8900F in specific versions allow an authenticated user to read or modify another user's command history due to an externally controlled filename.

IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0 and IBM DS8900F versions 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged roles due to improper privileged defined with unsafe actions.

IBM System Storage DS8A00 versions 10.1.3.0 through 10.11.35.0 and IBM DS8900F versions 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improper encoding of DSCLI command output, potentially obtaining sensitive information or causing a denial of service.

A vulnerability was found in search-indexer that allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster.

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

In TRENDnet TV-IP751WIC version 11.03.03, a command injection vulnerability exists in the file /cgi-bin/admin/set_time.cgi of the alphapd component. Manipulation leads to command injection. The attack can be initiated remotely, and the exploit is publicly available.

In TRENDnet TEW-821DAP version 2.2.01b05, a command injection vulnerability exists in the popen/system function of the file /cgi-bin/ping.cgi in the ssi component. Manipulating the ipaddr argument can lead to command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

RuoYi-Vue up to version 3.9.2 has a path traversal vulnerability in the fileDownload/resourceDownload function in CommonController.java. Manipulation of the fileName/resource argument allows remote attack, and the exploit has been made public.

A flaw was found in acm-operator-bundle. The build process downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.

In Netty prior to 4.1.137.Final and 4.2.17.Final, the default SniHandler constructors use the pre-handshake ClientHello aggregation path, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients.

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

The build process of mce-operator-bundle fetches and executes scripts from a remote repository without integrity checks, such as commit pinning or signature verification. A malicious actor with write access to the repository can inject and execute arbitrary code during the build. This compromises the build process and may lead to distribution of malicious software.

Tanium addressed a compression bomb vulnerability in Threat Response.