CVE Vulnerability Catalog

perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts. Attackers can control the 0th argument of packed executables to execute another executable, allowing them to bypass restrictions and gain unauthorized access.

R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authentication bypass and FM station setup access.

Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server.

An OS command injection vulnerability was discovered in ALLNET ALL-RUT22GW version 3.3.8 via the 'command' parameter in the popen.cgi endpoint. An attacker can remotely execute arbitrary system commands.

The ALLNET ALL-RUT22GW device version 3.3.8 was found to store hardcoded credentials in the libicos.so library. This means passwords or access keys are stored in plaintext within the binary file.

An Insecure Direct Object Reference vulnerability in Medtronic CareLink Network allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network before December 4, 2025.

Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This affects CareLink Network before December 4, 2025.

Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.

W NI System Web Server występuje podatność na przejście ścieżki względnej, która może prowadzić do ujawnienia informacji. Wykorzystanie tej podatności wymaga od atakującego wysłania specjalnie skonstruowanego żądania do serwera, co pozwala na odczyt dowolnych plików.

Improper signature verification vulnerability in auth0/node-jws versions 3.2.2 and earlier and 4.0.0. The jws.createVerify() function for HMAC algorithms may use user-provided data from the JWS protected header or payload in HMAC secret lookup routines, allowing attackers to bypass signature verification.

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0 allows attackers to set the Administrator password and username as blank values, allowing attackers to bypass authentication.

A flaw was found in WebKitGTK due to improper memory handling. Processing malicious web content can cause an unexpected process crash.

Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors.

W podatności 'Path Traversal' w aplikacji BeeDrive dla systemu Synology BeeDrive na desktop przed wersją 1.4.2-13960 występuje niewłaściwe ograniczenie ścieżki do zastrzeżonego katalogu. Umożliwia to lokalnym użytkownikom wykonanie dowolnego kodu za pomocą nieokreślonych wektorów.

W Synology BeeDrive dla systemu desktop przed wersją 1.4.2-13960 występuje luka związana z brakiem autoryzacji, która pozwala zdalnym atakującym na usuwanie dowolnych plików za pomocą nieokreślonych wektorów.

W podatności CVE-2025-54158 w aplikacji BeeDrive dla systemu Synology przed wersją 1.4.2-13960 brakuje uwierzytelnienia dla krytycznej funkcji. Umożliwia to lokalnym użytkownikom wykonanie dowolnego kodu za pomocą nieokreślonych wektorów.

In the Linux kernel, KVM for ARM64 lacks offset validation in the FF-A memory share operation. An untrusted large offset can cause out-of-bounds access in the hypervisor buffer.

W jądrze systemu Linux zidentyfikowano podatność w module be2net, która polega na przekazywaniu argumentu wrb_params jako NULL w funkcji be_insert_vlan_in_pkt(). Może to prowadzić do dereferencji wskaźnika NULL podczas przetwarzania specyficznego pakietu.