CVE Vulnerability Catalog

Saleor from version 2.10.0rc1 to 3.21.67, 3.22.63, and 3.23.22 treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can create an account with the victim's email address, and after the victim activates it, gain access to their order history and personal data.

Multiple Dell products (AppSync, Metro Node, UCC Edge, VxRail, PowerMax, Unity, PowerFlex Manager, PowerFlex Intelligent Catalog, PowerFlex Rack) contain a UNIX Symbolic Link Following vulnerability. A low privileged attacker with local access could exploit this vulnerability to escalate privileges.

This CVE candidate has been rejected and should not be used. All references and descriptions have been removed to prevent accidental usage.

An issue exists in Epson iProjection.apk v3.2.6 for the EH-TW5350 projector. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously.

A verification bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB.

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

Joomla! Core has an improper ACL check when injecting schema.org contact data. This allows contact information for inaccessible contact items to be injected into schema.org snippets.

Joomla! Core has an XSS vulnerability through schema.org outputs. Improper escaping flags lead to an XSS vector in schema.org markup outputs.

Joomla! Core has an improper ACL check for custom fields webservice endpoints. Unauthorized users can create fields for inaccessible components.

Joomla! Core has an improper CORS origin validation. An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

Joomla! Core has a response header injection vulnerability in download views. Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service.

RabbitMQ Java client library before 5.33.1 allows recursive calls to ValueReader.readFieldValue for AMQP types F and A without a nesting-depth limit. A malicious AMQP server or network intermediary can send about 580 nested table levels in the pre-authentication connection.start frame, causing StackOverflowError and terminating the client input processing thread, leading to denial of service.

RabbitMQ Java client library before 5.33.1 uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString field with type tag S and a declared length such as 0x7FFFFFFE, causing an approximately 2 GB allocation and OutOfMemoryError, potentially terminating the JVM and causing denial of service.

Dell PowerStore SDNAS contains an out-of-bounds write vulnerability in SMB/CIFS. An unauthenticated remote attacker can send a specially crafted SMB packet causing a crash (persistent if auto-restart is enabled) and potentially remote code execution.

A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource (CR) to specify an unvalidated image path. This lack of validation enables arbitrary code execution with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

A flaw in the Submariner operator allows exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token, granting full control over the mesh network and enabling unauthorized management of network resources such as endpoints and secrets.

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.

RabbitMQ Java client library before 5.33.0 passes a javaReturnType value from an untrusted system.describe response to Class.forName with initialization enabled. An attacker able to answer the JsonRpcClient request can select a class already present in the victim JVM and trigger its static initializer, potentially affecting confidentiality, integrity, and availability in the client process.