CVE Vulnerability Catalog

CVFS contained an XML external entity (XXE) reference handling issue affecting information disclosure. The vendor recommends upgrading to the resolved maintenance release.

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus.

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated but low-privilege SNMP user can invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The keys are shipped constants, not per-unit values, and are not rotated by the Administrator password reset, so they survive account provisioning.

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.

MCP Context Forge versions 0.2.0 through 0.3.1 store a prompt template without sufficient output encoding before rendering in the MCP Admin UI. An authenticated attacker can save markup with script-capable event handlers that execute when another user views the saved prompt. This enables stored XSS, interface alteration, phishing, keystroke observation, and actions in the victim's browser session.

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption.

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

InstallShield version 2025 R2 and earlier has a potential privilege escalation issue when running a compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers may also load from an unsecured location, potentially leading to privilege escalation.

HyperScale contained a path traversal issue affecting information disclosure. The vendor recommends upgrading to the resolved maintenance release.

A denial-of-service security issue exists in the affected product and version. The issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.

A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability applies only when the Block Sites feature is turned on.

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device's management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.

Listed NETGEAR Extender models have insufficient session randomness. A network-adjacent attacker with network access (such as WiFi credentials) can predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

A SQL injection vulnerability was found in girishsaraf Online-Appointment-Booking-System in the file Admin/getclinic.php of the AJAX Endpoint component. Manipulation of the city/cid argument allows remote exploitation, and the exploit has been made public. The project uses a rolling release model, so version information is unavailable, and the issue report has not been responded to.

A SQL injection vulnerability was found in girishsaraf Online-Appointment-Booking-System in the file Admin/deleteclinic.php of the Admin CRUD Endpoint component. Manipulation of the cid/did argument allows remote exploitation, and the exploit has been disclosed to the public. The project follows a rolling release approach, so version details are not provided, and the issue report has not been responded to.

A SQL injection vulnerability was detected in girishsaraf Online-Appointment-Booking-System in the file changebookingstatus.php. Manipulation of the dateselected argument allows remote exploitation, and the exploit is now public. The product uses a rolling release model, so specific version information is not available, and the issue report has not been responded to.

Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.