CVE Vulnerability Catalog

Podatność w Cisco Catalyst Center Virtual Appliance może pozwolić uwierzytelnionemu, zdalnemu atakującemu na podniesienie uprawnień do poziomu Administratora na podatnym systemie. Problem wynika z niewystarczającej walidacji danych wejściowych dostarczanych przez użytkownika.

Wykryto podatność bezpieczeństwa w cameasy Liketea 1.0.0, która dotyczy funkcji list w pliku laravel/app/Http/Controllers/Front/StoreController.php. Manipulacja argumentem lng/lat prowadzi do możliwości wstrzyknięcia SQL.

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).

ZITADEL is an open source identity management platform. A vulnerability in the federation process allows auto-linking users from external identity providers to existing users even if the IdP is inactive or federation is disallowed. This stems from failure to enforce organization-specific security settings during authentication.

MaxKB, an enterprise AI assistant, prior to version 2.3.1 allows a user to obtain sensitive information via Python code in the tool module, even though the process runs in a sandbox. Version 2.3.1 fixes the issue.

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilize on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used without sanitization to build the URL. This leads to middleware-based protected route bypass, DoS via cache poisoning, SSRF, URL pollution (potential SXSS), and WAF bypass. Version 5.15.5 contains a patch.

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can access internal network services such as databases through Python code in the tool module, although the process runs in a sandbox. Version 2.3.1 fixes the issue.

Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.

An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers. User-supplied CGI parameters are concatenated into system command strings without proper sanitization and executed via wl_exec_cmd.

A stack buffer overflow vulnerability was found in the setDefResponse function of the cstecgi.cgi binary in ToToLink LR1200GB and NR1800X routers. An unauthenticated attacker can send a crafted "IpAddress" parameter, causing a buffer overflow that may lead to arbitrary code execution.

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long, then directly inserts it into a system command using sprintf() and executes it with system().

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R, LR1200GB, NR1800X). The programs parse /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation, allowing an attacker to write beyond buffer boundaries.

A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB and NR1800X router firmware in the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation, potentially leading to arbitrary code execution or memory corruption without authentication.

A command injection vulnerability exists in the ToToLink A720R router firmware V4.1.5cu.614_B20230630 within the sysconf binary. The sub_40BFA4 function handling network interface reinitialization from '/var/system/linux_vlan_reinit' only partially validates input and concatenates it into shell commands executed via system() without escaping, allowing arbitrary command execution.

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell commands and executed via system() without any sanitization or escaping. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device.

Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.

Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.

Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.

The Zoom Workplace VDI Plugin macOS Universal installer before versions 6.3.14, 6.4.14, and 6.5.10 in their respective tracks follows symbolic links. An authenticated user may exploit this to disclose information via network access.