CVE Vulnerability Catalog

Hitachi Coding Software Suite up to version 3.3.0 transmits sensitive information in cleartext, allowing an attacker to eavesdrop on authentication credentials and sensitive data in transit.

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely.

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by manipulating the permission column during CSV bulk user registration.

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected is the function OrderController.addOrder in order/src/main/java/com/supermarket/order/controller/OrderController.java of the save Endpoint component. Manipulation of the userId argument leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used; the project was informed but has not responded.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin in versions up to and including 3.8.0 is vulnerable to Stored Cross-Site Scripting. A chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser, the Advisor task, and the Advisor dashboard widget allows an unauthenticated attacker to inject arbitrary web scripts into pages that execute when an administrator accesses the WordPress dashboard.

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. Unauthenticated attackers can extract customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values, which also enables deletion of arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint.

Improper initialization in certain ASUS motherboards allows a physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Details are provided in the 'Security Update for Multiple ASUS Motherboards' section of the ASUS Security Advisory.

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected to the router.

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the fetch function in src/shared/utils/ssrfGuard.js of the Search Endpoint component. Manipulation of the provider_options.baseUrl argument results in server-side request forgery. The attack can be initiated remotely. Applying a patch is the recommended action.

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. The vulnerability allows access to files outside the intended directory.

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction.

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. The save_file_b64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks.

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file. The vulnerability may allow access to files outside the intended directory.

modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file. The vulnerability may allow writing files outside the intended directory.

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.