CVE Vulnerability Catalog

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. Affects versions before 11.2.

A vulnerability was identified in zhayujie CowAgent up to 2.2.0 in the json.loads function of the Streaming Tool-Call Argument Handler. Manipulation leads to resource allocation issues. The attack can be initiated remotely and the exploit is publicly available.

Interuse i-Bos version 3.0 has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to manipulate database queries.

The LLCP implementation in Zephyr's Bluetooth LE Controller retains a receive node after accepting LL_PHY_UPDATE_IND, but invalid-PDU paths fail to release it before completing the procedure. An attacker can send a PDU sequence causing an assertion failure (device crash) or leaking nodes from the receive pool, leading to Bluetooth unavailability until reboot.

A vulnerability in the Bluetooth Link Layer control procedure code (ull_llcp_conn_upd.c) causes a retained RX node not to be released when the Connection Update / Connection Parameter procedure takes the 'invalid PDU, terminate the connection' path. This results in a leak of a node from the controller's RX pool. The issue is remotely triggerable by a peer device in radio range without pairing, bonding, or encryption.

The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation leaks a retained RX node (ctx->node_ref.rx). When the invalid PDU paths in ull_llcp_cc.c terminate the connection without releasing that retained node, the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() is broken. A peer device within radio range can trigger this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link.

Vulnerability in the I2S driver for Espressif (ESP32) chips in Zephyr OS. The i2s_esp32_trigger_check() function does not validate stream pointers for RX/TX directions, leading to NULL dereference when only one direction is configured. An unprivileged user-mode thread can call i2s_trigger() with an unsupported direction and cause a kernel panic (denial of service).

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus an uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of that call was discarded and the once guard was latched to true even when the call failed. Because sys_csrand_get() leaves the destination buffer untouched on failure, a single failed call left unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.

The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with 0x0F, yielding a value of 0..15. This value is used directly as the loop bound for filling the stack array point_reg[], sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS (Kconfig range 1..5, default 1). A controller reporting more points than the array holds causes up to 112 bytes of peer-supplied data to be written past the end of the array on the system workqueue thread's stack.

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive: the public API's channel delete returns the channel's platform access token and refresh token, and GET /user/organizations returns each organization's API key to every member. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization.

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.

pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths and posts.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download all sys_depart_role records, including role names, codes, descriptions and creating users.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every sys_comment row, including comment text and user ids on records they cannot access.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys_sms row, erasing records of sent notifications without ownership checks.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or Feishu integrations to redirect directory synchronisation and messaging to attacker-controlled applications or break them.

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete sys_user_position rows, detaching users from positions without logging.