CVE Vulnerability Catalog

OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.

CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input, allowing authenticated users with administrative privileges to execute arbitrary operating system commands.

CubeCart prior to version 6.7.0 contained an Authenticated Arbitrary File Upload vulnerability in the REST API File Manager endpoint. This allows any holder of an API key with files:rw permission to upload PHP files to the images/source/ directory, where they are executed by the web server.

CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates and Documents. The application unsafely evaluates user-supplied input through the Smarty template engine.

Podatność na Garmin WDU (w wersjach 1.4.6 i 5.0) umożliwia atak typu cross-site origin WebSocket hijacking. Atakujący może przejąć pełną kontrolę nad urządzeniem, wykorzystując WebSockety do zarządzania ustawieniami, w tym ustawieniami administracyjnymi.

In versions 3.0.7 and earlier, there is a Cross-Site Request Forgery (CSRF) vulnerability in MISP Modules that allows an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The issue was due to the home blueprint being exempted from CSRF protection.

In versions prior to 6.2.4, the fast-jwt library has a critical authentication-bypass vulnerability that allows unauthenticated attackers to forge arbitrary JWTs accepted as authentic.

CKAN, a data management system, had a vulnerability in datastore_search_sql that allowed attackers to bypass authorization and gain access to private resources and PostgreSQL system information. The issue is fixed in versions 2.10.10 and 2.11.5.

CKAN, an open-source data management system, had a vulnerability in datastore_search_sql that allowed attackers to inject SQL to gain access to private resources and PostgreSQL system information. This vulnerability is fixed in versions 2.10.10 and 2.11.5.

An SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a DoS condition.

In the vm2 library for Node.js prior to version 3.11.3, a vulnerability allows catching a host exception using the yield* expression inside an async generator. Closing the generator with the return function causes the value to be awaited, and exceptions thrown in the then call can be caught and passed as the next value to the yield* iterator, enabling sandbox escape and arbitrary command execution on the host system.

A vulnerability in the vm2 library for Node.js allows sandbox escape. The issue is fixed in version 3.11.2.

A vulnerability in the vm2 library for Node.js prior to version 3.11.2 allows sandbox escape via the neutralizeArraySpeciesBatch method, which can call into the host side using a getter on the array prototype. This enables attackers to obtain host objects and the Function object, leading to arbitrary command execution on the host system.

A vulnerability in the vm2 library for Node.js allows bypassing the require configuration in NodeVM with nesting enabled. Sandbox code can require the vm2 module, create a new NodeVM instance with unrestricted require, and execute arbitrary OS commands on the host.

A vulnerability in the vm2 library for Node.js allows an attacker to bypass sandboxing and access arbitrary object prototypes. The issue is fixed in version 3.11.0.

A vulnerability in the vm2 library for Node.js (versions 3.9.6 to 3.10.5) allows attacker-controlled JavaScript running in the sandbox to mutate host prototypes such as Object.prototype, Array.prototype, and Function.prototype. This occurs because the bridge exposes mutable proxies for real host-realm intrinsic prototypes and forwards sandbox writes to host objects using ReflectSet() and ReflectDefineProperty().

A vulnerability in vm2 prior to 3.11.0 allows bypassing the NodeVM builtin allowlist. When the 'builtin' module is allowed (even via '*' wildcard), sandboxed code can use Module._load() to load any module in the host context, bypassing restrictions. This enables loading excluded modules like child_process and achieving remote code execution.

A vulnerability in the vm2 library for Node.js prior to version 3.11.0 allows obtaining the host object. Attackers can use various methods, e.g., HostObject.getOwnPropertySymbols, to obtain Symbol(nodejs.util.inspect.custom) and escape the sandbox.

A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.