CVE Vulnerability Catalog

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could exploit this to cause Denial of Service and Elevation of Privileges.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler do not consistently enforce admin permissions. An authenticated non-admin operator can create or alter deviceActions or delete schedules, gaining access to device-value changes and server-side script execution.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the escapeTdString function does not escape backslashes, allowing a remote unauthenticated attacker to inject SQL via crafted sids tag identifiers. This can expose historical PLC tag values and device names.

Malcolm's upload-processing pipeline enforces limits on container archives but not on single-stream compressed formats. An authenticated user can upload a small, highly compressible file that decompresses to an unbounded size, exhausting the shared Docker volume and disrupting the platform.

Malcolm's nginx Lua RBAC layer matches patterns against the raw, percent-encoded request URI, while nginx routes requests using the decoded URI. This allows an authenticated low-privilege user to access admin-only paths by percent-encoding the path, bypassing restrictions.

The Sierra Wireless HL7800 cellular modem driver (up to v4.4.0) contains a vulnerability involving out-of-bounds writes on the stack while parsing AT responses. Most handlers write a NUL terminator one byte past the end of a 128-byte buffer, while the +KCELLMEAS handler allows a full stack buffer overflow with data from response lines longer than 128 bytes.

Lemur before version 1.9.3 contains a vulnerability in _validate_revocation_url that does not properly validate URLs after HTTP redirects, allowing access to internal addresses (loopback, RFC1918, link-local, instance-metadata). Additionally, there is a time-of-check time-of-use window enabling DNS rebinding attacks. An operator uploading a certificate via POST /api/1/certificates/upload can trigger unwanted internal requests.

Vitess version 24.0.2 and earlier has a vulnerability in the /debug/vrlog endpoint that does not check ACL permissions (missing acl.CheckAccessHTTP). A remote attacker with access to the vttablet debug HTTP port can bypass the security policy and stream VrLogStats data, including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and Online DDL workflows.

Lemur before version 1.9.2 has a vulnerability in the JWT verifier that uses an unverified algorithm from the token header. In the default configuration, PyJWT rejects alg=none, so it is not a direct authentication bypass, but it is a defense-in-depth gap. After migration to asymmetric signing, algorithm confusion may occur, and algorithm-based anomaly detection is weakened.

Lemur before version 1.9.2 has a vulnerability in lemur.users.service.update that assigns a replacement password directly to users.password, without invoking hash_password (registered only for the before_insert event). As a result, administrator-initiated password changes via PUT /api/1/users/ are stored in plaintext, preventing normal login and exposing passwords.

Lemur before version 1.9.2 has a vulnerability in PUT /api/1/roles/ that authorizes updates based on role membership rather than administrator-only. This allows a non-admin member to add or remove other users and rename the role, potentially leading to privilege escalation and denial of access.

Lemur before version 1.9.2 has a vulnerability in lemur/certificates/verify.py that accepts CRL and OCSP URLs from uploaded certificates without adequate destination validation. An authenticated operator can upload a certificate via POST /api/1/certificates/upload and cause verify_string to reach internal addresses such as loopback, RFC1918, link-local, or instance-metadata (e.g., 169.254.169.254). Additionally, the CRL path uses an unbounded cache, potentially leading to memory exhaustion.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause an absolute path traversal. A successful exploit might lead to code execution.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.

Otalio Ship Property Management System before version 2.22.0 contains a vulnerability due to unescaped stored values in the application security page. Authenticated attackers can escalate privileges via persistent cross-site scripting (XSS).

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP requests.

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

Wazuh 4.0.0 through 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a malicious node name and disconnect, triggering the master's peer cleanup routine to remove the contents of arbitrary directories within the Wazuh installation path writable by the wazuh user.

Wazuh 4.0.0 through 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

kin-openapi, a Go project for handling OpenAPI files, from 0.2.0 until 0.144.0 contains a NULL-pointer-dereference denial of service vulnerability in openapi3filter.ValidateRequest when an operation declares a content parameter whose application/json media type has no schema. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.