CVE Vulnerability Catalog

A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.

A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The vulnerability affects the isPathAllowed function in src/tools/filesystem.ts and involves symlink following. The attack can only be performed locally, with high complexity and difficult exploitability, but the exploit has been publicly disclosed. The vendor explains that restriction features are guardrails for LLMs, not hardened security boundaries, and recommends using Desktop Commander with Docker for isolation. This vulnerability only affects products no longer supported by the maintainer.

Zidentyfikowano słabość w urządzeniach D-Link DIR-852 do wersji 20251002, która dotyczy nieznanej części pliku /HNAP1/. Manipulacja w tym obszarze może prowadzić do wstrzyknięcia poleceń.

A SQL injection vulnerability was discovered in SourceCodester Farm Management System 1.0 in /uploadProduct.php. Manipulation of the Type argument allows remote attack execution. The exploit is publicly available.

Podatność w ABB MConfig polegająca na przechowywaniu w pamięci wrażliwych informacji w postaci niezaszyfrowanej. Problem dotyczy wersji MConfig do 1.4.9.21.

Framelink Figma MCP Server w wersjach przed 0.6.3 pozwala nieautoryzowanemu zdalnemu atakującemu na wykonywanie dowolnych poleceń systemu operacyjnego poprzez spreparowane żądanie HTTP POST zawierające metaznaki powłoki. Wrażliwy punkt końcowy nieprawidłowo oczyszcza dane wejściowe dostarczane przez użytkownika, co umożliwia atakującemu wstrzykiwanie złośliwych poleceń.

A SQL injection vulnerability exists in SourceCodester Farm Management System 1.0 in /buyNow.php. Manipulation of the Name argument allows remote attack. The exploit is publicly available.

A vulnerability in SourceCodester Student Grades Management System 1.0 affects the add_user function in /admin.php of the Manage Users Page component. Manipulation of first_name/last_name arguments causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed.

A SQL injection vulnerability was found in Blood-Bank-And-Donation-Management-System (up to dc9e0393d826fbc85fad9755b5bc12cba1919df2) in the file /donate_blood.php. Manipulating the fullname argument allows remote attack. The exploit has been publicly disclosed and may be used. The product uses a rolling release system, so version information is not disclosed.

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet.

HAProxy Kubernetes Ingress Controller before version 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.

In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.

Synapse, an open source Matrix homeserver implementation, lacks validation for device keys before version 1.138.3 and in version 1.139.0, allowing an attacker registered on the victim homeserver to degrade federation functionality and unpredictably break outbound federation to other homeservers. The issue is patched in versions 1.138.3, 1.138.4, 1.139.1, and 1.139.2, but 1.138.3 and 1.139.1 introduced an unrelated regression, so skipping them is recommended.

Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares.

Wykryto podatność w SourceCodester Simple E-Commerce Bookstore w wersji 1.0, która dotyczy nieznanej funkcji w pliku /register.php. Manipulacja argumentem register_username prowadzi do wstrzyknięcia SQL.

W systemie zarządzania rezerwacjami weselnymi SourceCodester w wersji 1.0 wykryto podatność bezpieczeństwa. Dotyczy ona funkcji insertReservation w pliku function.php, gdzie manipulacja argumentem number prowadzi do wstrzykiwania SQL. Atak może być przeprowadzony zdalnie.

A fastjson deserialization vulnerability was discovered in WukongCRM-9.0-JAVA via the /OaExamine/setOaExamine interface. An attacker can remotely exploit this flaw to execute arbitrary code.

A SQL injection vulnerability was identified in SourceCodester Farm Management System 1.0 in the file /myCart.php. Manipulation of the pid argument leads to SQL injection, and remote exploitation is possible. The exploit has been made publicly available and could be exploited.

W systemie zarządzania rezerwacjami weselnymi SourceCodester w wersji 1.0 odkryto lukę bezpieczeństwa. Podatność ta dotyczy nieznanego kodu w pliku /global.php i umożliwia wstrzyknięcie SQL poprzez manipulację argumentem User.

Zidentyfikowano podatność w SourceCodester Simple E-Commerce Bookstore w wersji 1.0, która dotyczy nieznanej części pliku /index.php. Manipulacja argumentem login_username prowadzi do wstrzykiwania SQL.