CVE Vulnerability Catalog

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product stores passwords using the MD5 hash function without applying a per-password salt. Because MD5 is a fast, unsalted hash, an attacker who obtains the password database can efficiently perform offline dictionary, rainbow-table, or brute-force attacks to recover the original passwords. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware (versions ≤ 4.7.18.0.eden) contains a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware (versions ≤ 4.7.18.0.eden) contains an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

Ilevia EVE X1 Server firmware (versions ≤ 4.7.18.0.eden) contains an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected XSS vulnerability in index.php, allowing an unauthenticated attacker to execute arbitrary script in the victim's browser. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

Icinga DB Web provides a graphical interface for Icinga monitoring. Before 1.1.4 and 1.2.3, an authorized user with access to Icinga DB Web, can use a custom variable in a filter that is either protected by icingadb/protect/variables or hidden by icingadb/denylist/variables, to guess values assigned to it. Versions 1.1.4 and 1.2.3 respond with an error if such a custom variable is used.

Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specify files on the server and when their format is supported by the used PhpSpreadsheet library they would be included and their content leaked to the user.

IBM MQ versions 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD are vulnerable to a denial of service caused by improper enforcement of the timeout on individual read operations. A remote attacker could exploit this via slowloris-type attacks to cause a denial of service.

Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by an Insecure Direct Object Reference issue in a UI component that can only be used to read data.

A vulnerability in Apeman ID71 EN75.8.53.20 affects a function in the /set_alias.cgi file. Manipulation of the alias argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.

A path traversal vulnerability has been detected in Shazwazza Smidge up to 4.5.1, in the Bundle Handler component. Manipulation of the Version argument allows remote exploitation.

A vulnerability in GNU Binutils 2.45 affects the vfinfo function in the ldmisc.c file. Manipulation leads to an out-of-bounds read. The attack can only be executed locally. The exploit is publicly available. The patch is called 16357.

W systemie CraftMyCMS w wersji 4.0.2.2 występuje podatność na wstrzykiwanie nagłówka Host w funkcji resetowania hasła. System bezpośrednio wykorzystuje `$_SERVER['HTTP_HOST']` do konstruowania linków resetujących hasło wysyłanych e-mailem, co umożliwia atakującym manipulację nagłówkiem Host.

FelixRiddle dev-jobs-handlebars w wersji 1.0 wykorzystuje absolutne linki do resetowania hasła, które opierają się na niezweryfikowanym nagłówku `req.headers.host` i wymuszają schemat `http://`. Atakujący, który może kontrolować nagłówek `Host`, może spowodować, że linki do resetowania będą wskazywać na domeny kontrolowane przez niego.

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Framework versions include 6.2.0-6.2.11, 6.1.0-6.1.23, 6.0.x-6.0.29, and 5.3.0-5.3.45, as well as older unsupported versions.

Wersje Spring Cloud Gateway Server Webflux mogą być podatne na ujawnienie zmiennych środowiskowych i właściwości systemowych atakującym. Aplikacja jest uznawana za podatną, gdy spełnione są określone warunki dotyczące użycia Spring Expression Language (SpEL) oraz dostępności niebezpiecznych punktów końcowych.

Aggie w wersji 2.6.1 posiada podatność na wstrzykiwanie nagłówka Host w funkcjonalności resetowania hasła, co umożliwia atakującemu zresetowanie hasła użytkownika.