CVE Vulnerability Catalog

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. An attacker could gain unauthorized access to the system by using tokens that should not be accepted.

Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. The update (PUT) and delete (DELETE) handlers for /api/v1/credentials omit the authentication call, unlike other routes. Any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential without authentication. All published versions through 6.5.4 are affected; fixed in 6.5.5 by adding authentication.

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on confidentiality and integrity and no impact on availability.

Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads attacker-controlled input and writes it into the DOM without proper sanitization, causing script execution in the victim's browser. This could allow access or modification of information within the victim's browser scope, impacting confidentiality and integrity, while availability remains unaffected.

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page displaying this content, the injected input is processed during web page generation, resulting in script execution in the victim's browser. This could allow the attacker to access session information, modify rendered page content, and disrupt the victim's use of the application, with low impact on confidentiality, integrity, and availability.

SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.

SAP Cloud Connector contains an improper authorization check that could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network and could allow obtaining limited information about internal systems.

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. The issue affects the eval function in the file ultralytics/nn/autobackend.py of the AutoBackend Model Loading component. Manipulation of the imgsz/names/kpt_shape arguments results in code injection. The attack must be initiated locally. The project was informed but has not responded.

A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. The issue affects the get_obj_from_str function in the file src/utils/model_utils.py of the Config-Driven Model Instantiation component. Manipulation of the Target argument leads to code injection. The attack must be carried out locally. The product uses a rolling release system, so version information is not disclosed. The project was informed but has not responded.

A weakness has been identified in ModelTC LightX2V up to 0.5.0. The issue affects the AutoTokenizer.from_pretrained function in the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the Tokenizer component. Manipulation of the auto_map argument causes code injection. The attack is restricted to local execution. The exploit has been made public and could be used for attacks. The project was informed but has not responded.

A security flaw was discovered in philz1337x clarity-upscaler in the create_html_for_item function of modules/ui_extra_networks.py (Extra Networks Card Rendering component). Manipulation of the Description argument results in cross-site scripting (XSS), and the attack can be executed remotely.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. This vulnerability may lead to data disclosure or disruption of file services.

A vulnerability in the Zephyr Bluetooth host stack causes a double-free of a net_buf in the ATT transmit path when signing fails. Additionally, on a bt_l2cap_send_pdu() failure, a buffer may be reused with a stale signature, leading to an out-of-bounds write. This results in memory corruption, crashes, or potential code execution.

A vulnerability in the Bluetooth Mesh stack in Zephyr causes a permanent loss of message contexts from the pool, leading to denial of service (DoS) after pool exhaustion. An attacker in the mesh network can intentionally trigger context leaks, and the device stops responding to requests until reboot.

In the Bluetooth Mesh Access-layer delayable message queue (subsys/bluetooth/mesh/delayable_msg.c), three lists and one delayed work item are shared between two cooperative threads without synchronization. A missing NULL check after sys_slist_get() and a race between bt_mesh_delayable_msg_manage() and delayable_msg_handler() allow a read-modify-write through a NULL-based pointer, faulting the system workqueue thread or resetting the node. The flaw does not lead to memory corruption or code execution — the impact is loss of availability of the affected node.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.