CVE Vulnerability Catalog

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the OS, allowing arbitrary command execution with root privileges.

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

The vulnerability allows an authenticated user with "DNA Authority - Operator" privilege to tamper with serialized data, potentially leading to code execution during deserialization under the privileges of the "DNA Apps" security group.

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.

In Capstone before version 6.0.0-Alpha9, the public cs_insn_name() API forwards instruction IDs to M68K and RISCV backends without proper bounds checks, potentially causing an out-of-bounds read and process crash.

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.

Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. The `nodeId` parameter is unsanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL, including reading, modifying, and deleting data from the PostgreSQL database. SQL errors are reflected in XML messages, enabling data exfiltration.

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

A command injection vulnerability in Security Center allows a remote, unauthenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the service account.

An authenticated command injection vulnerability in Security Center related to file upload processing allows an attacker to execute arbitrary commands on the underlying operating system by uploading a specially crafted file.

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

An improper access control vulnerability allows an authenticated non-administrative user to view settings outside their assigned scope.

CSRF tokens were generated using a predictable method, reducing their effectiveness. This has been addressed by improving randomness and entropy of token generation.

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.