CVE Vulnerability Catalog

Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.

Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.

Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.

Vulnerability in Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0 allows an attacker to manipulate the filename upon upload, enabling arbitrary file path traversal when file system storage is used.

DJI drones contain an FTP service with hardcoded credentials shared across affected models, allowing authenticated users to upload files without limits and overwrite files in **/blackbox/upgrade/**. An attacker with network or USB RNDIS access can exhaust storage, preventing flight records and firmware updates. Uploaded files persist across reboot and factory reset.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured output can use the password to access the TLS client key.

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

In wicked up to version 0.6.80, an out-of-bounds read exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() incorrectly reports the payload length, causing the DHCPv4 client to read up to 68 bytes past the receive buffer. An unauthenticated attacker on the same network can cause adjacent heap memory to be interpreted as DHCP options.

In wicked up to version 0.6.80, an integer underflow exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() does not verify that the IP total length field is at least as large as the IP header length before subtracting. An unauthenticated attacker on the same network can trigger an out-of-bounds read, potentially crashing the daemon.

The debug and test interface in Johnson Controls T2000 has improper access control, allowing access to functionality not properly constrained by ACLs. This affects T2000 versions before 31.6.

DoXBASE by BilPark has a cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation, allowing Cross Zone Scripting. This affects DoXBASE through 27082026.

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Affected versions: Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, 5.3.0 - 5.3.49, and 5.2.25.RELEASE and earlier.

Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, are exposed to man-in-the-middle interception of every log event. Affected Spring AMQP versions: 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ip_address parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection.

Dool up to version 1.3.8 is vulnerable to CSV injection when exporting data to CSV, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, injecting malicious formulas into the CSV output that execute when opened in a spreadsheet.

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116.