CVE Vulnerability Catalog

This vulnerability allows a Backup or Tape Operator to write files as root.

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

A vulnerability in the AppConnector component of enaio (versions up to 10.10.0.183, 11.0.0.183, and 11.10.0.183) allows authenticated remote attackers to inject arbitrary SMTP commands via crafted input to the /osrest/api/organization/sendmail endpoint.

e-invoice pro by Insiders Technologies GmbH before release 1 Service Pack 2 has an issue that allows a remote attacker to cause a denial of service via a crafted script.

This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file.

A vulnerability in Technitium DNS Server version 13.5 allows a remote attacker to cause a Denial of Service (DoS) via the rate-limiting component.

iccDEV before version 2.3.1.2 has a heap-buffer-overflow vulnerability in `CIccCLUT::Init()` at `IccProfLib/IccTagLut.cpp`. This affects users processing ICC color profiles. Version 2.3.1.2 contains a patch.

Mastodon, a free, open-source social network server based on ActivityPub, has a vulnerability in its protection mechanism that blocks requests to local IP addresses. Some IP address ranges are missing, allowing an attacker to make Mastodon perform HTTP requests against loopback or local network hosts, potentially accessing private resources and services. This is fixed in Mastodon v4.5.4, v4.4.11, v4.3.17 and v4.2.29.

OpenMetadata versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges. Version 1.11.4 contains a patch.

Foomuuri, a firewall management tool, has a vulnerability involving improper neutralization of argument delimiters, which can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects versions before 0.31.

The GL-iNet GL-AXT1800 router firmware v4.6.8 contains a command injection vulnerability in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges.

The phpgurukul Hostel Management System v2.1 contains a Cross-Site Scripting (XSS) vulnerability in the user-provided complaint field (Explain the Complaint) submitted via /register-complaint.php. Injected HTML/JavaScript is stored and rendered unescaped in the admin viewer (/admin/complaint-details.php?cid=<id>), causing it to execute in the admin's browser.

The Open eClass platform before version 4.2 contains an arbitrary file upload vulnerability in the theme import functionality. An attacker with administrative privileges can upload arbitrary files to the server because files inside the ZIP archive are not validated or sanitized. This leads to remote code execution on the web server. Version 4.2 patches the issue.

In RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.

RustFS before version 1.0.0-alpha.79 has a vulnerability in the ImportIam admin API that incorrectly validates permissions using ExportIAMAction instead of ImportIAMAction. This allows a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.

Snuffleupagus to moduł, który zwiększa koszty ataków na strony internetowe poprzez eliminację klas błędów i zapewnienie systemu wirtualnych poprawek. W wersjach Snuffleupagus przed 0.13.0, przy włączonej funkcji walidacji przesyłania plików i skonfigurowanej do użycia jednego z upstreamowych skryptów walidacyjnych opartych na Vulcan Logic Disassembler (VLD), wszystkie pliki z wieloczęściowych żądań POST były oceniane jako kod PHP, jeśli rozszerzenie VLD nie było dostępne dla CLI SAPI.

Foomuuri contains an improper authorization vulnerability that allows arbitrary users to influence the firewall configuration. This issue affects versions before 0.31.

An External Control of File Name or Path vulnerability in smb4k before version 4.0.5 allows local users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba share.

An improper neutralization of argument delimiters in a command (Argument Injection) vulnerability allows local users to perform arbitrary unmounts via the smb4k mount helper.

Asseco ADMX system is used for processing medical records. It allows logged-in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in version 6.09.01.62 of ADMX.