CVE Vulnerability Catalog

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the NAME parameter in /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.

A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().

W Mbed TLS przed wersją 3.6.6 oraz 4.x przed wersją 4.1.0 oraz w TF-PSA-Crypto przed wersją 1.1.0 odkryto problem związany z przewidywalnym ziarnem w generatorze liczb pseudolosowych (PRNG).

Mbed TLS w wersjach od 3.3.0 do 3.6.5 oraz w wersji 4.0.0 umożliwia obniżenie poziomu algorytmu. Atakujący może wykorzystać tę podatność do wymuszenia użycia słabszych algorytmów kryptograficznych.

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights allows an authenticated, remote attacker to write arbitrary files to the system. The issue is due to insufficient validation of the metadata update file.

A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information. This issue exists because authentication details are included in the encrypted backup files.

Multiple stored cross-site scripting (XSS) vulnerabilities were discovered in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1. Attackers can inject malicious JavaScript or HTML payloads into the First Name and Last Name parameters, leading to script execution in other users' browsers.

OpenViking versions 0.2.5 through 0.2.13 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials.

In the Linux kernel KVM subsystem for x86, a vulnerability was found where an existing shadow-present SPTE is not dropped before installing an emulated MMIO SPTE. This can cause a warning and potential misbehavior when host userspace modifies guest memory.

Wykorzystanie po zwolnieniu pamięci w CSS w Google Chrome przed wersją 146.0.7680.178 umożliwia zdalnemu atakującemu wykonanie dowolnego kodu wewnątrz piaskownicy za pomocą spreparowanej strony HTML.

Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. This issue affects Connext Professional from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, and from 4.3x before 5.2.*.

Claude SDK for Python versions 0.86.0 to before 0.87.0 has a vulnerability in the async local filesystem memory tool. Path validation is performed but the unresolved path is returned, allowing a local attacker to use symlinks to escape the sandbox.

Claude SDK for TypeScript versions 0.79.0 to before 0.81.0 contains a vulnerability in the local filesystem memory tool that validates model-supplied paths using a prefix check without appending a trailing path separator, allowing reads and writes outside the sandboxed memory directory.

In the Claude SDK for Python (versions 0.86.0 to before 0.87.0), the local filesystem memory tool creates memory files with mode 0o666, making them world-readable on systems with standard umask and world-writable in permissive umask environments like many Docker images. A local attacker on a shared host can read agent state, and in containers can modify memory files to influence model behavior.

FreeScout, a help desk system built with Laravel, has a bug in the checkIpByMask() function that checks if the input IP contains a '/' character. Plain IP addresses never contain '/', so the function always returns false without checking CIDR ranges. Private ranges 10.0.0.0/8 and 172.16.0.0/12 remain unprotected. Affects versions prior to 1.8.211.

FreeScout before version 1.8.211 has a host header manipulation vulnerability that allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External Resource Loading and Open Redirect behavior. A fix is available in version 1.8.211.

cpp-httplib is vulnerable to HTTP Request Smuggling. The server does not consume the GET request body, and on keep-alive connections unread bytes are interpreted as a new request.