CVE Vulnerability Catalog

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call.

Nieprawidłowe rozwiązywanie linków przed dostępem do plików w kliencie AWS VPN dla macOS w wersjach 1.3.2-5.2.0 pozwala lokalnemu użytkownikowi na wykonanie kodu z podwyższonymi uprawnieniami. Niewystarczające kontrole walidacji w katalogu docelowym logów podczas rotacji logów mogą umożliwić użytkownikowi niebędącemu administratorem utworzenie symlink z pliku logu klienta do uprzywilejowanej lokalizacji.

A weakness has been identified in D-Link DI-7001 MINI 24.04.18B1. Impacted is an unknown function of the file /upgrade_filter.asp. This manipulation of the argument path causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

A security flaw has been discovered in kaifangqian/kaifangqian-base up to commit 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file SysUserController.java. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited. This product does not use versioning, so information about affected and unaffected releases is unavailable.

LLaMA-Factory before version 0.9.4 contains an SSRF vulnerability in the chat API that allows any authenticated user to force the server to make arbitrary HTTP requests to internal and external networks. The same mechanism also allows for Local File Inclusion (LFI), enabling reading arbitrary files from the server's filesystem. The issue is in the `_process_request` function in `src/llamafactory/api/chat.py`, which does not validate URLs.

Dependency-Track prior to version 4.13.5 may send credentials meant for a private NuGet repository to api.nuget.org via the HTTP Authorization header, and may disclose names and versions of components marked as internal. This can happen if the instance contains .NET components, a custom NuGet repository has been configured with authentication credentials, and the repository server does not provide PackageBaseAddress resource in its service index. The issue has been fixed in 4.13.5. Workarounds include disabling custom NuGet repositories until the patch is applied, invalidating previous credentials, and generating new ones.

A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.

Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enable a remote attacker to execute arbitrary JavaScript code in the context of the attacked user's browser session.

A vulnerability in SourceCodester Hotel and Lodge Management System 1.0 in /del_tax.php allows manipulation of the ID argument leading to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.

A SQL injection vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_tax.php. Manipulation of the percentage argument allows remote attack execution. The exploit has been publicly disclosed and may be used.

A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data.

The 'zipfile' module in Python did not validate the offset value in the ZIP64 EOCD Locator record. Instead, it assumed the ZIP64 EOCD record is the previous record. This can be abused to create ZIP archives handled differently by 'zipfile' compared to other ZIP implementations. The fix maintains this behavior but checks that the offset matches the expected value.

W systemach Dell PowerProtect Data Domain BoostFS dla systemów Linux Ubuntu występuje podatność związana z nieprawidłowym przypisaniem uprawnień. Atakujący z niskimi uprawnieniami i lokalnym dostępem może wykorzystać tę podatność, co prowadzi do nieautoryzowanego dostępu.

W podatności CVE-2025-3450 występuje niewłaściwe blokowanie zasobów w komponencie SDM oprogramowania B&R Automation Runtime w wersjach przed 6.3 oraz przed Q4.93. Może to umożliwić nieautoryzowanemu atakującemu z sieci usunięcie danych, co prowadzi do warunków odmowy usługi.

IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 is vulnerable to a stack-based buffer overflow due to improper bounds checking. A local user with access to CECSUB or CECRM files on the container could overflow the buffer and execute arbitrary code on the system.

IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users on the host network to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /del_booking.php. Manipulation of the ID argument allows remote attack execution. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /del_curr.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

W systemie zakupów online PuneethReddyHC w wersji 1.0 występuje podatność na wstrzyknięcie SQL w pliku edit_product.php. Parametr GET product_id jest niebezpiecznie przekazywany do zapytania SQL bez odpowiedniej walidacji lub parametryzacji.

A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /pages/save_curr.php. Manipulation of the currcode argument causes SQL injection. The attack can be carried out remotely. The exploit has been published and may be used.