CVE Vulnerability Catalog

W usłudze zarządzania użytkownikami i uwierzytelnianiem MAS (Matrix Authentication Service) występuje błąd logiczny, który pozwala atakującemu z dostępem do uwierzytelnionej sesji MAS na wykonywanie wrażliwych operacji bez podawania aktualnego hasła. Dotyczy to wersji od 0.20.0 do 1.4.0, a problem został naprawiony w wersji 1.4.1.

ClipBucket V5 version 5.5.2 - #140 and earlier contains a blind SQL injection vulnerability in the /admin_area/login_as_user.php file in the Admin Area. Exploitation requires access privileges to the Admin Area.

W BitVisor występuje podatność na zapis poza granicami w emulacji urządzenia sieciowego VirtIO, która pozwala lokalnym atakującym na spowodowanie awarii hypervisora gospodarza poprzez spreparowany dostęp do przestrzeni konfiguracyjnej PCI. Wykorzystanie tej podatności może prowadzić do wykonania dowolnego kodu lub eskalacji uprawnień z gościa do hosta.

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain an observable response discrepancy vulnerability. The application's 'Forgot Password' endpoint returns distinct JSON responses depending on whether the supplied email address is associated with an existing account. Because the responses differ in the `data.exist` boolean value, an unauthenticated remote attacker can enumerate valid email addresses/accounts on the server. NOTE: D-Link states that a fix is under development.

D-Link Nuclias Connect firmware versions up to 1.3.1.4 contain an observable response discrepancy vulnerability. The 'Login' endpoint returns distinct JSON responses depending on whether the username exists. An unauthenticated remote attacker can enumerate valid usernames.

D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry.

A vulnerability was found in Apeman ID71 218.53.203.117. An unknown function of the file /onvif/device_service in the ONVIF Service component allows manipulation resulting in missing authentication. The attack is possible remotely and the exploit has been made public.

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492.

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. The Automate 2025.9 patch enforces HTTPS for all agent communications.

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.

MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendered directly in the MQTTX message viewer. If exploited, this could allow attackers to execute arbitrary scripts in the context of the application UI — for example, attempting to access MQTT connection credentials or trigger unintended actions through script injection. This vulnerability is especially relevant when MQTTX is used with brokers in untrusted or multi-tenant environments, where message content cannot be fully controlled. This vulnerability is fixed in 1.12.1.

Envoy prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10 can experience TCP connection pool crashes due to flow control management issues. This happens when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN.

PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5) contains a vulnerability allowing hijacking of the target PayPal merchant account from the backoffice due to incorrect usage of the PHP array_search() function. The flaw is fixed in versions 4.4.1 and 5.0.5.

PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.

PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not be permitted to. A fix is included in versions 2.15.1, 2.14.7, and 2.13.13.

Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. Any API user with access to an API endpoint that allows specifying a filter expression can crash the Icinga 2 daemon.

Icinga 2 versions 2.4 through 2.15.0 allow authenticated API users to access variables and objects that should be hidden, including global variables and objects not permitted by permissions. Fixed in 2.15.1, 2.14.7, and 2.13.13.

The file mexcel.php in Vfront 0.99.52 contains a vulnerability due to insecure deserialization of user-controlled input. The unserialize function is called on base64-decoded $_POST['mexcel'] data without validation or the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to remote code execution, SQL injection, path traversal, or denial of service.

Hardcoded credentials were found in the ATLAS-EPIC source code in commit f29312c (2025-05-26). This means authentication data is directly embedded in the repository, readable by anyone with code access.