CVE Vulnerability Catalog

FUXA version 1.3.2 and earlier allows an authenticated non-admin user to control property.address in the device-webapi-request handler, causing the FUXA server to issue outbound HTTP/HTTPS requests and return the response to the attacker. This leads to an SSRF vulnerability.

FUXA version 1.3.2 and earlier improperly handled session refresh, allowing an attacker with a previously issued privileged refresh cookie or access token to continue minting privileged JWTs even after account deletion, disablement, role removal, or demotion. This enabled continued unauthorized access to user management, project manipulation, runtime configuration, and backdoor-account creation. The issue is fixed in version 1.3.3.

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

In openHiTLS 0.2.0 through 0.3.2, during X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.

ZEBRA (Zcash node) before version 4.5.0 has a vulnerability allowing an unauthenticated IPv4 peer to deterministically terminate a synced node. By completing a P2P handshake and advertising an invalid mempool transaction, the attacker can trigger an assertion in the code, causing a panic/abort that stops the node. The issue is fixed in version 4.5.0.

ZEBRA prior to 4.5.0 can be terminated by a malicious block producer by placing the same shielded transaction in a non-finalized parent block and its child. The uniqueness assertion is reachable before contextual validation, and release builds use panic=abort, terminating the process.

ZEBRA prior to 4.5.0 can be permanently halted by a consensus-valid block containing a long chain of transparent self-spends. The credit-first ordering can cause the intermediate balance to exceed MAX_MONEY, leading to a panic in release builds. The block is accepted by zcashd, so the halt persists after restart.

ZEBRA prior to 4.5.0 can be slowed down by a malicious P2P peer that answers getblocks/FindBlocks with a small inventory and serves a block with coinbase height far above the local tip. The error is not attributed to the peer, causing cancellation of downloads and a 67-second sync delay. The peer is not scored or disconnected, so it can repeat the attack.

ZEBRA before version 4.5.0 has a vulnerability allowing a remote unauthenticated P2P peer to stall a node by racing an invalid block body against the valid canonical body for the same block header hash. This causes the node to reject the valid body and remain stuck one height behind until restart or reorganization. The issue is fixed in version 4.5.0.

ZEBRA, a Zcash node written in Rust, before version 4.5.0 can accept a block that zcashd rejects due to undercounting the P2SH signature-operation counter for scripts containing a disabled opcode. An attacker can exploit this to cause a chain split, affecting network integrity and availability.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after the RATE_LIMIT_DELAY timeout. This leads to unbounded memory growth and potential node crash.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, a chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. This can lead to incorrect subtree roots served to consumers like lightwalletd, causing wallet sync failures.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in the inbound mempool download pipeline. This can cause honest transactions to be rejected with MempoolError::FullQueue.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, an attacker authenticated to an enabled RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId with multi-byte UTF-8 characters. This triggers a Rust panic, and release builds use panic=abort, killing the process.

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function.

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service.

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could exploit this to cause Denial of Service and Elevation of Privileges.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler do not consistently enforce admin permissions. An authenticated non-admin operator can create or alter deviceActions or delete schedules, gaining access to device-value changes and server-side script execution.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the escapeTdString function does not escape backslashes, allowing a remote unauthenticated attacker to inject SQL via crafted sids tag identifiers. This can expose historical PLC tag values and device names.

FUXA before version 1.3.2 has a vulnerability allowing a remote unauthenticated attacker to perform SSRF (Server-Side Request Forgery) via the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers. By manipulating property.address or endpoint connection data, the attacker can make the server call axios.get against arbitrary HTTP/HTTPS destinations, including internal services, cloud metadata, OPC UA, or ODBC services. The issue is fixed in version 1.3.2.