CVE Vulnerability Catalog

The TeamDavid Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered.

The search functionality in the TeamDavid Webbox application accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathnameroot” parameter is possible without authentication.

Path traversal vulnerability in the archive creation functionality of TeamDavid Webbox. An attacker can manipulate the archive path to create folders in arbitrary locations, including sensitive directories like C:\Windows.

Local file inclusion vulnerability in the send email, fax, SMS functionality of TeamDavid Webbox. By using the '@@attach' command in the 'scjob' field, files can be attached, and the filter restricting access to config and user folders can be bypassed via alternate data streams, allowing download of sensitive files like other users' access files with passwords or the server's private key.

Arbitrary file deletion vulnerability in the send email, fax, SMS functionality of TeamDavid Webbox. By using the '@@COMMENTFILE' command in the 'scjob' field, any file on the system can be deleted.

DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable.

Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.

Vulnerability allowing access to unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the device's web interface.

SQL injection vulnerability in /social/ajax.php?action=login in Photo Share Website 1.0. Manipulation of the 'email' argument results in SQL injection, which can be exploited remotely. The exploit has been made public.

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

The Content Views WordPress plugin before version 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitize attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

The Subscriptions for WooCommerce WordPress plugin before version 2.0.1 does not verify the user's capability before installing and activating a plugin from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack plugin-management capabilities) to install and activate arbitrary plugins, resulting in remote code execution.

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before version 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.

A vulnerability in V-Secure Jingyun Antivirus 2.4.2.39 involves an unknown function in the library ZyArk.sys (kernel driver). Manipulation leads to improper access controls. The attack requires local access. The exploit has been publicly disclosed.

A flaw in Jiangmin Antivirus 21 affects the function MessageNotifyCallback in the library kvcore.sys (Minifilter Port component). Manipulation leads to improper access controls. The attack requires local access. The exploit has been published.

A vulnerability in DeepCool DisplayService 1.2.12 affects unknown processing in the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Manipulation results in improper access controls. The attack must be initiated locally. The exploit is public.

A security vulnerability in StableBit DrivePool 2.3.13.1687 affects unknown code in the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe (DrivePoolService component). Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been publicly disclosed.