CVE Vulnerability Catalog

JAXB factory methods rely solely on FEATURE_SECURE_PROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker can read local files via out-of-band XXE.

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

Vulnerability in Netis WF2409E 3.3.42541 affects an unknown function of the Wireless Settings component. Manipulation of the SSID argument results in cross site scripting (XSS). Attack can be performed remotely.

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android, involving the function syncInvoke of the WebView JS Bridge component, which leads to exposed dangerous routine.

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used.

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker running a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress, leading to use of freed memory and potentially crashing the GNOME session or arbitrary code execution in the compositor.

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The checkTemplate() validation restricts relative directory traversal sequences but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The item_name parameter does not sanitize directory traversal sequences, allowing an authenticated user with UPDATE-level permissions to write files outside the expected templates directory, including web-accessible paths. Additionally, the translation-writing logic does not escape backslashes, allowing inputs to break out of PHP string literals and inject executable code. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with web-server privileges.

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install() method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system(), exec(), file_put_contents(), and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the underlying server.

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the 'next' parameter, enabling reflected Cross-Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker-controlled JavaScript.

In Thelia v2.6.0, both the admin login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate admin accounts. Lack of rate limiting facilitates scalable attacks.

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the 'Add New Address' form, the application redirects them to the URL specified in the 'next' parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation relying solely on client-supplied MIME types. An administrator can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the server.

In Thelia v2.6.0, the document update endpoint does not perform the same validation as the upload endpoint, which blocks executable file types. An attacker with administrative Thelia permissions can exploit this to upload arbitrary executable files, such as malicious PHP scripts, achieving remote code execution.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.

Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.