CVE Vulnerability Catalog

A flaw in TRENDnet TV-IP751WIC (version 11.03.03) affects functions SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, FUN_00432574, and FUN_0043372C in the alphapd component. Manipulation leads to stack-based buffer overflow, exploitable remotely.

A SQL injection vulnerability has been detected in EasyReport up to 2.0.17.0522_Beta, in ModuleController.java, within Move Operations. Manipulation of the sourcePath argument allows remote attack. The exploit has been publicly disclosed, and the project has not responded.

Plainpad through 1.1.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint. Dead code in App\Http\Kernel.php leaves the throttle configuration unattached. Attackers can also cause CPU exhaustion via repeated bcrypt comparisons.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Buffer overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated.

An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c.

Lemur before version 1.9.3 contains a vulnerability in API endpoints that allows an unprivileged user to create a duplicate certificate without required permissions and then revoke it, potentially leading to denial of service for all certificates. The fix in version 1.9.3 rejects duplicates and requires authority access.

Lemur prior to 1.9.3 has a vulnerability in CertificateExport where the CertificatePermission ownership check was inside the plugin.requires_key branch. A plugin with requires_key false bypassed the check, and the handler still passed the private key and logged a key_view audit event. The fix does not pass private keys to plugins that do not require them.

Lemur prior to 1.9.3 did not require AuthorityPermission on the parent authority when creating a sub-CA if ADMIN_ONLY_AUTHORITY_CREATION was false. An authenticated non-read-only user could create a sub-CA and use the parent's private key to sign a new intermediate, allowing issuance of trusted certificates outside normal controls.

Lemur up to version 1.9.3 did not enforce CertificatePermission checks when assigning identifiers to the replaces field in certificate create, upload, and edit requests. This allowed an attacker with non-read-only access to disable victim certificate notifications and mark them as replaced, potentially leading to deployment of attacker certificates on victim endpoints. The issue is fixed in version 1.9.3.

Lemur before version 1.9.3 exposed GET /api/1/destinations and GET /api/1/destinations/ with only authentication, without requiring admin permission, and responses included raw options with plaintext passwords and private keys. This allowed a read-only user to retrieve credentials for remote certificate-deployment hosts. The issue is fixed in version 1.9.3.

Lemur before version 1.9.3 did not enforce the ACME directory host allowlist when updating acme_url via PUT /api/1/authorities/, allowing an authority-role user to set the URL to an internal service or cloud metadata address (e.g., 169.254.169.254). During the next issuance operation, Lemur made an outbound request to that address, potentially exposing internal services or cloud metadata. The issue is fixed in version 1.9.3.

Lemur before version 1.9.3 allowed an authority-role user to update acme_url without revalidation and direct the ACME client to an attacker-controlled server. That server could return URLs (newNonce, newOrder, authorizations, finalize) pointing to internal services or cloud metadata, and Lemur followed them without host validation. The issue is fixed in version 1.9.3.

FUXA version 1.3.2 and earlier has a vulnerability in the allowDashboard authorization gate that allows a remote unauthenticated attacker to obtain a signed guest token and access the Node-RED editor and flow deployment API. The attacker can deploy malicious nodes or execute scripts, gaining control over project data, configuration, and potentially the operating system.

FUXA version 1.3.2 and earlier does not check isSocketAdminAuthorized for certain Socket.IO events (DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, DEVICE_TAGS_REQUEST) when secureEnabled is true. A remote unauthenticated or guest user can collect system-discovery information not required for normal HMI viewing.