CVE Vulnerability Catalog

The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the integrity of the system.

Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

W oprogramowaniu konfiguracyjnym ThinkPlus zgłoszono podatność, która może pozwolić lokalnemu uwierzytelnionemu użytkownikowi na ominięcie uwierzytelniania urządzenia ThinkPlus i zarejestrowanie nieautoryzowanego odcisku palca.

W oprogramowaniu konfiguracyjnym ThinkPlus zgłoszono potencjalną podatność, która może umożliwić lokalnie uwierzytelnionemu użytkownikowi dostęp do wrażliwych informacji o urządzeniu.

Zgłoszono potencjalną podatność w niektórych pamięciach USB ThinkPlus, która może umożliwić użytkownikowi z fizycznym dostępem do urządzenia odczyt danych przechowywanych na nośniku.

Wtyczka Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin dla WordPress jest podatna na ślepą injekcję SQL poprzez parametry `order` i `append_where_sql` w wersjach do 1.6.9.9 włącznie. Problem wynika z niewystarczającego zabezpieczenia parametrów dostarczanych przez użytkownika oraz braku odpowiedniego przygotowania istniejącego zapytania SQL.

SumatraPDF to czytnik wielu formatów dla systemu Windows. W wersji 3.5.2 i wcześniejszych występuje podatność na niezaufaną ścieżkę wyszukiwania, gdy aktywowane są ustawienia zaawansowane. Aplikacja uruchamia notepad.exe bez określenia ścieżki bezwzględnej, co pozwala na wykonanie złośliwego notepad.exe umieszczonego w katalogu instalacyjnym aplikacji.

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14.

Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0, the API endpoint GET /api/v1/oauth-apps.get is exposed to any authenticated user, regardless of their role or permissions. This endpoint returns an OAuth application, as long as the user knows its ID, including potentially sensitive fields such as client_id and client_secret. This vulnerability is fixed in 6.12.0.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.

NVIDIA NSIGHT Graphics dla systemu Linux zawiera podatność, która umożliwia atakującemu wstrzyknięcie poleceń. Udany atak może prowadzić do wykonania kodu, eskalacji uprawnień, manipulacji danymi oraz odmowy usługi.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

In FreeRDP prior to version 3.20.1, a vulnerability exists due to missing bounds checking on server-supplied MSUSB_INTERFACE_DESCRIPTOR values. The URBDRC client uses these values as indices in libusb_udev_complete_msconfig_setup, causing an out-of-bounds read.

In FreeRDP before version 3.20.1, a global buffer overflow was observed in the Base64 decoding path. The root cause is implementation-defined char signedness: on Arm/AArch64 builds, plain char is treated as unsigned, so the guard c <= 0 can be optimized into a simple c != 0 check, allowing non-ASCII bytes (0x80-0xFF) to bypass the intended range restriction and be used as an index into a global lookup table, causing out-of-bounds access.