CVE Vulnerability Catalog

In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure without additional execution privileges. User interaction is not needed for exploitation.

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure without additional execution privileges. User interaction is not needed.

In the isCallerAllowed function of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure without requiring additional execution privileges. User interaction is not needed for exploitation.

An insufficient input validation vulnerability in NETGEAR RAX series routers allows a network-adjacent attacker with network access (e.g., WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. The crash does not affect core services like WiFi.

In aircheng-org iWebShop-5 up to 5.15, a vulnerability exists in controllers/admin.php of the Authentication Storage component. Manipulating the Password argument leads to a password hash with insufficient computational effort. The attack can be launched remotely but has high complexity and is difficult to exploit. The exploit has been published. The project was informed but has not responded.

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

A Cross-Site Scripting (XSS) vulnerability in Microsoft Office SharePoint is due to improper input neutralization during web page generation. It allows an authorized attacker to perform spoofing over a network.

InstantCMS versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php, lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

A NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiOS 7.4 and 7.2 (all versions), FortiPAM (multiple versions), and FortiProxy 7.6.0-7.6.6, 7.4, and 7.2 (all versions) may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.

A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

A vulnerability in star7th showdoc up to 3.9.1 affects unknown code in the file web_src/public/editor.md/editormd.js of the API Page Save Endpoint. Manipulation can lead to cross-site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 resolves the issue. The patch sets Mermaid 'securityLevel' to 'strict', disables 'htmlLabels', and sanitizes rendered SVG with DOMPurify.

XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the privacy policy or terms of service.

XenForo before version 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher, allowing limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions. Attackers can invoke the approval queue job under any user identity to approve queued registrations without required permissions, causing the moderation log to attribute actions to an impersonated account.

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials, and any operation performed by the victim is attributed to the attacker's account.

An exposed IOCTL with insufficient access control in the Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request, bypassing the driver's verification. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.