CVE Vulnerability Catalog

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

An unauthenticated remote attacker can force the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

A vulnerability in multiple Mitsubishi Electric products allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could lead to disruption of control functions or incorrect operation, causing a denial-of-service (DoS) condition.

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. An attacker with access to one path can abuse boundary handling to read or write paths outside the intended filesystem allowlist. This affects Node.js main, 22.x, 24.x, and 26.x.

When enabling Spring Boot DevTools support for a remote application target from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affects Spring Tools for Eclipse 5.2.0 and earlier.

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affects Spring Tools for Eclipse 5.2.0 and earlier.

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affects Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier.

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the initiating operator, allowing a lower-privileged account that an operator is switched into to be resolved as that operator and switch into any permitted account, including an administrator, resulting in full account takeover.

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label from a request parameter, and does not escape that label when echoing it on the filter admin page. An unauthenticated attacker can trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored XSS via CSRF).

The Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status. Unauthenticated users can create orders marked as paid without completing any payment.

The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration. Unauthenticated users can register directly into a privileged group and be granted that group's configured role, up to Administrator, leading to privilege escalation.

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a plugin option. Unauthenticated users can overwrite a site-wide WP Travel Engine option (the public nonce is served to anonymous visitors).