CVE Vulnerability Catalog

FTC E-Commerce Management Panel before version 1.0.2 contains a missing authentication for critical function vulnerability, allowing authentication bypass.

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header via the jsondir API endpoint, leading to arbitrary SQL execution and file writes using PostgreSQL functions, enabling remote code execution.

CentreStack before 17.2 contains an authentication bypass vulnerability. An unauthenticated attacker can read, write, or delete arbitrary account settings by exploiting exposed API endpoints lacking authorization checks. Attackers can forge valid encrypted EntAcctId values using a static shared encryption key, enabling enumeration of tenant domains and administrator identities.

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability. An unauthenticated attacker can supply a malicious URL to the SharePoint storage configuration handler, causing the server to fetch and parse attacker-controlled XML with external DTD references, leading to exfiltration of files such as Web.config containing database credentials and cryptographic keys.

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An unauthenticated attacker can supply a crafted base64-encoded XML string to exposed API endpoints, triggering creation of arbitrary local OS user accounts via the NetUserAdd Windows API.

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A user with VM deployment privileges can trigger an out-of-bounds read, potentially leading to information disclosure or a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact is restricted to information disclosure.

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this URL, allowing the attacker to obtain the token.

A flaw was found in koku-metrics-operator. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this URL, allowing the attacker to obtain the token.

The Subscriptions for WooCommerce plugin for WordPress (all versions up to and including 2.0.0) fails to properly verify user authorization in the wps_sfw_install_plugin_configuration AJAX handler, allowing authenticated attackers with shop manager-level access or higher to install and activate arbitrary WordPress.org plugins.

Improper input validation in the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges, resulting in unrestricted access to the device.

Improper input validation in the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain privileged user access to the device.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its unverified `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash into different hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` to connect to an arbitrary attacker-chosen host.

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled, an unauthenticated attacker can perform a Denial-of-Service attack.

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.