CVE Vulnerability Catalog

Nezha Monitoring prior to version 2.0.13 has a vulnerability in the NoRoute handler in the dashboard that allows access to admin assets without authentication. By exploiting an incorrect URL prefix check, an attacker can access system files.

Nezha Monitoring versions from 1.4.0 to before 2.0.8 allow RoleMember users to create scheduled cron tasks that can execute arbitrary commands on servers, including those belonging to other users. This poses a risk of unauthorized access to systems.

A web page containing unusual WebGPU content can load it into the GPU GLES render process, leading to an out-of-bound write in the GPU user-space driver. This may result in memory corruption and possible browser/GPU process crash.

Vulnerability in sanitize-html library (versions prior to 2.17.4) in default configuration allows bypassing sanitization and injecting HTML/JavaScript via the <xmp> element. This can lead to stored XSS in applications rendering sanitized output.

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations, leading to request forgery and impersonation.

SQL injection vulnerability in MariaDB (versions 3.3.18 and 3.4.8) despite using mysql_real_escape_string() with big5 charset. Fixed in versions 3.3.19 and 3.4.9.

A vulnerability in MariaDB on Windows with the CONNECT engine installed and REST support enabled allows interpolation of the table HTTP attribute into the curl command line without proper sanitization. This enables the user to execute shell commands on the server.

Aqara Home Android app (version 6.0.0) and white-label clients embedding the same liblumidevsdk.so library use hard-coded cryptographic keys (CWE-321). This allows an unauthenticated remote attacker to compromise confidentiality and integrity of data with a CVSS score of 9.1 (Critical).

The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching. This is an instance of CWE-1289: Improper Validation of Unsafe Equivalence in Input.

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes unauthenticated bidirectional AES access to the platform's signing key. This is a missing authentication for a critical function and use of a risky cryptographic algorithm.

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is a missing authorization (CWE-862) with a critical CVSS score of 9.6.

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) uses a hardcoded OAuth client credential, violating CWE-798 (Use of Hard-coded Credentials). This vulnerability has an estimated CVSS score of 9.1 (Critical) and allows unauthenticated remote attacks.

The Pause+ mobile app has a vulnerability related to improper restriction of excessive authentication attempts, allowing authentication bypass.

A vulnerability in the jmespath.php library allows an attacker to execute arbitrary PHP code when using the `JmesPath\CompilerRuntime` with an attacker-controlled JMESPath expression. The compiler fails to properly escape function names, enabling injection of malicious code into the generated cache file, which is then executed.

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to write arbitrary files to the store's media directory without authentication. Attackers can upload PHP files, potentially leading to remote code execution.

In vm2, prior to version 3.11.4, a sandbox escape vulnerability allowed arbitrary code execution in the host process when untrusted code was executed with async support. This issue has been patched in version 3.11.4.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, vm2 suffers from a sandbox breakout vulnerability, allowing attackers to execute arbitrary commands on the host system.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins, but the denylist misses process and inspector/promises, allowing sandboxed code to bypass restrictions.

In versions prior to 3.11.4, the vm2 library contained a vulnerability that allowed bypassing security related to the 'nesting: true' and 'require: false' options. The strict equality check in the code did not function correctly, enabling unauthorized requirements.