CVE Vulnerability Catalog

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.

Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a manipulation of the argument Pid can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in meetecho janus-gateway up to 1.4.2, affecting unknown code in html/demos/admin.js of the Admin API component. The manipulation leads to hard-coded credentials. The attack can be executed remotely, and the exploit has been publicly disclosed.

A weakness was identified in meetecho janus-gateway up to 1.4.2, affecting src/plugins/janus_videoroom.c of the VideoRoom component, causing a race condition. Remote exploitation is possible but has high complexity and is difficult. A patch named 27c0d1af888153e818675b56a4e6267f62d57097 is available.

A SQL injection vulnerability was discovered in Zen Cart up to 2.2.2, affecting admin/modules.php of the Module Configuration component, via manipulation of the configuration argument. The attack can be launched remotely, and the exploit is publicly available. Patch identified as 08f572654edee1db8f9db091c9949825c6c69339.

A SQL injection vulnerability was identified in Zen Cart 2.2.2, affecting the eval function of admin/configuration.php in the Admin Panel component, via manipulation of the gID argument. The attack can be initiated remotely, has high complexity, and is difficult to exploit. The exploit is publicly available. The vendor explains that set_function/use_function are not editable through any normal admin UI.

A code injection vulnerability was identified in Zen Cart up to 2.2.2, affecting the zen_call_function function of admin/includes/functions/general.php in the Administrative Module Management component, via manipulation of the use_function argument. The attack can be launched remotely, has high complexity, and is difficult to exploit. The exploit has been publicly disclosed. The vendor states they do not consider this an independently exploitable vulnerability.

A vulnerability in ash_typescript (npm) before 0.19.1 allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. This affects AshTypescript.Rpc.ErrorBuilder.build_error_response/1 and paths involving cast_map_to_struct/2 and format_field_type/1.

A vulnerability was found in RuoYi up to version 4.8.3 in the checkRoleAllowed function of the /system/role/authDataScope file. Manipulation of the roleKey argument leads to improper privilege management. The attack can be launched remotely and the exploit has been publicly disclosed.

A flaw was found in DataEase up to version 3.0.0 in the Utils.buildCalcField function of the file io/dataease/engine/utils/Utils.java. Manipulation of the calculated field argument causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A vulnerability was detected in Kamailio up to versions 6.0.7/6.1.3 in the isup_get_calling_party function of the file src/modules/sipt/ss7_parser.c in the sipt module. Manipulation of the length argument results in buffer overflow. The attack may be performed remotely.

A security vulnerability was detected in Tencent WeKnora up to version 0.8.1 in the validateSubquery function of the file internal/utils/inject.go in the SQL Validator component. The manipulation leads to SQL injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

A weakness was identified in agno-agi agno up to versions 3.0.6/3.1.1 in the member_agent.run function in the library libs/agno/agno/team/_default_tools.py in the Delegation Feature component. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely and the exploit has been made public.

A vulnerability was determined in agno-agi agno up to version 3.0.9 in the agno.CodingTools.run_shell function in the library libs/agno/agno/tools/coding.py in the CodingTools component. Manipulation of the command argument causes OS command injection. The attack may be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was found in agno-agi agno up to version 3.0.6 in the run_python_code function of the file python.py in the PythonTools component. Manipulation of the code argument results in code injection. The attack can be launched remotely and the exploit has been made public.

The Custom Query Blocks plugin for WordPress up to version 5.6.0 contains a stored XSS vulnerability in the post-type-archive-mapping function. The vulnerability is due to improper neutralization of input during web page generation.