CVE Vulnerability Catalog

Joomla Extension Articles Anywhere (regularlabs.com) versions < 20.0.0 contains a privileged stored XSS vulnerability via the link option. The extension accepts link options such as onclick and onmouseover, which in affected versions become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.

Joomla Extension Tabs & Accordions (regularlabs.com) versions < 3.1.0 contains a privileged stored XSS vulnerability via the rtla-alias option. The extension rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.

Joomla Extension Quick Index (regularlabs.com) versions < 5.0.5 contains a privileged stored XSS vulnerability via the class option. The extension inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.

The Modals extension for Joomla (regularlabs.com) below version 17.0.0 treats destinations using executable browser URL schemes as ordinary modal URLs. The value can reach both the generated link and the iframe-loading path, enabling privileged stored XSS without using the separate Pro JavaScript Events feature.

SolarView Compact contains an OS command injection vulnerability in Schedule Settings. An attacker who can log in to the product may execute arbitrary OS commands.

An unrestricted upload of a file with a dangerous type exists in the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. A remote authenticated attacker can upload a specially crafted file, potentially leading to arbitrary code execution on the product.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. An attacker who can log in to the product may execute arbitrary OS commands.

An improper neutralization of directives in dynamically evaluated code ('Eval Injection') exists in CONPROSYS HMI System (CHS). An attacker who can log in to the product may execute arbitrary code.

An unrestricted upload of a file with a dangerous type exists in CONPROSYS TM Series. A remote authenticated attacker can upload a specially crafted file, potentially leading to arbitrary command execution on the product.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS TM Series. An attacker who can log in to the product may execute arbitrary OS commands.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS PAC Series. An attacker who can log in to the product may execute arbitrary OS commands.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. An attacker who can log in to the product may execute arbitrary OS commands.

A buffer overflow vulnerability exists in Contec EC1000 series. A remote attacker can send a specially crafted request to the product's web service, potentially leading to arbitrary program execution.

A buffer overflow vulnerability exists in Contec RP-WAH-SR Series. A remote attacker can send a specially crafted request to the product's web service, potentially leading to arbitrary program execution.

A path traversal vulnerability exists in SGA1000. An attacker with FTP access to the product may view and/or alter arbitrary files on the server.

An OS Command Injection issue exists in SGA1000 due to improper neutralization of special elements. An attacker who can log in to the product may execute arbitrary OS commands.

A path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. An attacker with FTP access to the product may view and/or alter arbitrary files on the server.

An OS Command Injection issue exists in Contec FX5000 series, FX4000 series, and FX3000 series due to improper neutralization of special elements. An attacker who can log in to the product may execute arbitrary OS commands.

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location pointing to internal endpoints such as the cloud metadata service (169.254.169.254) and retrieve the response by downloading the image data.

The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If a crafted DLL is present in the same directory when the affected installer is invoked, arbitrary code may be executed with the privileges of the user who performed the installation.