CVE Vulnerability Catalog

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

In conductor-oss conductor 3.22.0, the MCPService.listTools function in MCPService.java (MCP Service component) improperly handles the mcpServer argument, leading to Server-Side Request Forgery (SSRF). The attack can be initiated remotely, and the exploit has been made public.

In conductor-oss conductor 3.31.2, the ListApiToolsTask.start function in ListApiToolsTask.java (API Tool Configuration component) improperly handles the specUrl argument, leading to Server-Side Request Forgery (SSRF). The attack can be carried out remotely, and the exploit has been disclosed to the public.

In fit2cloud MeterSphere up to 3.6.9-lts, the Swagger3ParserApiDefinition.testUrlTimeout function in Swagger3ParserApiDefinition.java (Swagger3 Parser component) improperly handles the swaggerUrl argument, leading to Server-Side Request Forgery (SSRF). The attack can be carried out remotely, and the exploit is now public. The vendor was contacted but did not respond.

A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The TRENDnet TEW-432BRP router version 3.10B20 contains a stack-based buffer overflow in the formTcpipSetup function of /goform/formTcpipSetup. Manipulating the Name argument allows remote attack, and the exploit has been publicly disclosed.

A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

In Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), and multiple Desigo PXC/PXM devices (All versions >= V2.3), the affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

In RUGGEDCOM CROSSBOW (All versions < V6.0), affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.

In RUGGEDCOM CROSSBOW (All versions < V6.0), affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves improper restriction of access to database queries used for subnet management. An authenticated attacker could read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to improper restriction of access to various database queries, allowing users to retrieve system-wide information not intended for their privilege level. An authenticated attacker could gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves missing proper authorization checks for device disconnection requests. An authenticated attacker with minimal privileges could disconnect active sessions of other users, including administrators, leading to a denial of service.

In RUGGEDCOM CROSSBOW (all versions before V6.0), affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to lack of input validation and sanitization in the Name and Value fields for custom file labels. An authenticated attacker with administrative privileges could execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) allows unauthorized access to sensitive configuration items via specific database queries. An authenticated attacker can retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves lack of validation and sanitization of firmware filenames during upload. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to lack of validation and sanitization of the Value field in notification conditions during Notification Profile configuration. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.