CVE Vulnerability Catalog

Apache Karaf's config:install command is not covered by any ACL rule and is therefore allowed for any authenticated user, including one with only the viewer role. The command fetches a file from an arbitrary URL and writes it into karaf.etc, which contains security-relevant files such as users.properties, keys.properties, host.key, and all ACL configuration files. With the --override flag, existing files can be overwritten, and Felix FileInstall automatically reloads changed .cfg files without requiring a restart.

Progress Telerik Fiddler Everywhere before version 8.2.0 exposes privileged IPC functionality. A local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application can replace the application UI or settings with attacker-controlled content.

A vulnerability has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected is some unknown functionality of the file users.php, where manipulation of the Search argument causes cross site scripting, and the attack can be initiated remotely.

A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602 in the file application/database.php of the Database Management component. Manipulation leads to execution with unnecessary privileges. The attack can be launched remotely, and the exploit is public.

A security flaw was discovered in MODSetter SurfSense up to 0.0.36 in the file surfsense_backend/app/routes/editor_routes.py of the Document Export Feature. Manipulation results in server-side request forgery. The attack can be initiated remotely, and the exploit is public. Upgrading to version 0.0.36.3 is recommended.

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5 in the escapeshellcmd function of the file ajax/openvpn/del_ovpncfg.php of the OpenVPN Configuration Handler. Manipulation of the cfg_id argument leads to OS command injection. The attack can be launched remotely, and the exploit is public.

A flaw has been found in RaspAP raspap-webgui up to 3.5.5 in the WiFiManager::writeWpaSupplicant function of the file src/RaspAP/Networking/Hotspot/WiFiManager.php of the SSID Processing component. Manipulation of the ssid argument causes OS command injection. The attack can be initiated remotely, and the exploit is public.

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper authorization checks.

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2 in an unknown function of the file libopendmarc/opendmarc_policy.c of the DMARC Parser component. Manipulation of the pct argument leads to integer overflow. Remote exploitation is possible, and the exploit is public.

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2 in the opendmarc_get_tld function of the file libopendmarc/opendmarc_tld.c of the PSL Wildcard Handler component. Executing a manipulation leads to origin validation error. The attack may be launched remotely, and the exploit is public.

A vulnerability in the SMP-over-console transport in Zephyr RTOS allows an unauthenticated attacker to trigger a buffer length underflow by sending a single 7-byte frame to the management console. This leads to an out-of-bounds read, potentially causing a denial of service on the MCUmgr thread or memory disclosure.

A vulnerability in the Zephyr LwM2M stack (subsys/net/lib/lwm2m/lwm2m_message_handling.c) causes a NULL pointer dereference when handling CoAP WRITE/CREATE requests with a Block1 option. An attacker can trigger a fourth block transfer after exhausting the block1_contexts pool (default 3), leading to a system crash (BusFault or reset).

In Zephyr RTOS, a vulnerability exists in the BSD socket layer where an asynchronous error was stored in the user_data field of the network context, which for listening TCP sockets is used to store a pointer to the parent context. In v4.3.0, after an interface-down event, the accept callback was not disarmed, leading to reuse of the poisoned value as a pointer and writes to an invalid address, causing a kernel fatal error (device crash or reset).

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.