CVE Vulnerability Catalog

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, potentially leading to session information theft, portal content manipulation, or user redirection.

The affected code used child_process.execSync with a shell string for generator installation and uninstallation. An attacker could execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value, because the value was passed directly to the shell without sanitization.

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organization is specified using an organization ID. An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organization they are not authorized to administer.

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. An attacker could gain unauthorized access to the system by using tokens that should not be accepted.

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on confidentiality and integrity and no impact on availability.

Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads attacker-controlled input and writes it into the DOM without proper sanitization, causing script execution in the victim's browser. This could allow access or modification of information within the victim's browser scope, impacting confidentiality and integrity, while availability remains unaffected.

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page displaying this content, the injected input is processed during web page generation, resulting in script execution in the victim's browser. This could allow the attacker to access session information, modify rendered page content, and disrupt the victim's use of the application, with low impact on confidentiality, integrity, and availability.

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. The issue affects the eval function in the file ultralytics/nn/autobackend.py of the AutoBackend Model Loading component. Manipulation of the imgsz/names/kpt_shape arguments results in code injection. The attack must be initiated locally. The project was informed but has not responded.

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. The issue affects the get_obj_from_str function in the file src/utils/model_utils.py of the Config-Driven Model Instantiation component. Manipulation of the Target argument leads to code injection. The attack must be carried out locally. The product uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

A weakness has been identified in ModelTC LightX2V up to 0.5.0. The issue affects the AutoTokenizer.from_pretrained function in the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the Tokenizer component. Manipulation of the auto_map argument causes code injection. The attack is restricted to local execution. The exploit has been made public and could be used for attacks. The project was informed but has not responded.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. This vulnerability may lead to data disclosure or disruption of file services.

A vulnerability in the Zephyr Bluetooth host stack causes a double-free of a net_buf in the ATT transmit path when signing fails. Additionally, on a bt_l2cap_send_pdu() failure, a buffer may be reused with a stale signature, leading to an out-of-bounds write. This results in memory corruption, crashes, or potential code execution.

A vulnerability in the Bluetooth Mesh stack in Zephyr causes a permanent loss of message contexts from the pool, leading to denial of service (DoS) after pool exhaustion. An attacker in the mesh network can intentionally trigger context leaks, and the device stops responding to requests until reboot.

In the Bluetooth Mesh Access-layer delayable message queue (subsys/bluetooth/mesh/delayable_msg.c), three lists and one delayed work item are shared between two cooperative threads without synchronization. A missing NULL check after sys_slist_get() and a race between bt_mesh_delayable_msg_manage() and delayable_msg_handler() allow a read-modify-write through a NULL-based pointer, faulting the system workqueue thread or resetting the node. The flaw does not lead to memory corruption or code execution — the impact is loss of availability of the affected node.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

A vulnerability in Linketic CityGaussian up to 2.0 affects the function parse_cfg_args in internal/utils/common.py of the Sidecar Parsing component. Manipulation of the argument cfg_args leads to code injection. The attack can only be performed locally. The project was informed but has not responded.