CVE Vulnerability Catalog

Local privilege escalation vulnerability due to DLL hijacking. Affects Acronis True Image for Windows before build 42902.

Rack::Multipart::Parser incorrectly unfolds folded multipart headers, preserving CRLF in parameter values. This can lead to header injection or HTTP response splitting in applications using these values.

A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. The function vpn_drop in the file /setup.cgi is affected by OS command injection via manipulation of the argument policy_name. The attack can be launched remotely and the exploit has been disclosed. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A flaw has been found in Trendnet TEW-657BRM 1.00.1. The function vpn_connect in the file /setup.cgi is affected by OS command injection via manipulation of the argument policy_name. The attack can be launched remotely and the exploit has been published. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. The function ping_test in the file /setup.cgi is affected by OS command injection via manipulation of the argument c4_IPAddr. The attack can be launched remotely and the exploit is now public. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

An OS command injection vulnerability was found in Trendnet TEW-657BRM router version 1.00.1 in the Edit function of the /setup.cgi file. Manipulating the pcdb_list argument allows remote command execution. The vendor confirmed the product is discontinued and unsupported since 2011.

Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.

In the Rack library (modular Ruby web server interface) versions prior to 2.2.23, 3.1.21, and 3.2.6, the Rack::Files#fail method sets the Content-Length header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared length is smaller than the actual bytes sent. An attacker can trigger this mismatch by requesting a non-existent path with percent-encoded UTF-8 characters, leading to incorrect HTTP response framing and potential response desynchronization in deployments relying on the wrong Content-Length value.

In Rack prior to versions 2.2.23, 3.1.21, and 3.2.6, a vulnerability was found in Rack::Sendfile#map_accel_path. Injecting the X-Accel-Mapping header into a regular expression without proper escaping allows an attacker to control the X-Accel-Redirect header, potentially leading to serving unauthorized files via nginx.

Rack before versions 2.2.23, 3.1.21, and 3.2.6 has a denial of service vulnerability due to an unlimited number of byte ranges in the HTTP Range header. An attacker can supply many small overlapping ranges, causing disproportionate CPU, memory, I/O, and bandwidth consumption.

Rack::Static incorrectly evaluates header rules on the raw URL-encoded PATH_INFO, while the file is served after decoding. A request for an encoded variant of a path can bypass the intended security headers.

Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If the root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output.

In the Rack interface (versions before 2.2.23, 3.1.21, and 3.2.6), a DoS vulnerability exists in the Rack::Utils.select_best_encoding method. An unauthenticated attacker can send a request with a crafted Accept-Encoding header, causing excessive CPU consumption by Rack::Deflater.

Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.

In the firmware update mechanism of the Qianniao QN-L23PA0904 device (version 20250721.1640), a vulnerability allows an attacker to gain root access, install backdoors, and exfiltrate data by supplying a crafted iu.sh script from an SD card.

A user enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered on the platform.

A weakness has been identified in Trendnet TEW-657BRM 1.00.1. The function add_wps_client in the file /setup.cgi is affected by OS command injection via manipulation of the argument wl_enrolee_pin. The attack can be launched remotely and the exploit has been made public. The vendor confirmed the product is end-of-life since 2011 and no patch will be released.

A bypass was found in OWASP Core Rule Set (CRS) before versions 3.3.9 and 4.25.0. By inserting whitespace in the filename (e.g., photo. php), files with dangerous extensions (.php, .phar, .jsp, .jspx) can be uploaded without being blocked.

In Textpattern up to version 4.9.1, the function mt_uploadImage in file rpc/TXP_RPCServer.php (XML-RPC Handler component) is vulnerable to path traversal via manipulation of the file.name argument. Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability in LibRaw up to 0.22.0 in the function LibRaw::nikon_load_padded_packed_raw. Manipulating load_flags/raw_width arguments leads to an out-of-bounds read. The attack can be remote.