CVE Vulnerability Catalog

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below).

Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send.

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. This issue exists because of an incorrect fix for CVE-2022-23491.

A bodyclass XSS issue was discovered in Paessler PRTG before version 23.3.86.1520. The vulnerability allows injection of malicious script into the application interface.

A missing authentication vulnerability was determined in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (API Command Endpoint component). The manipulation causes missing authentication. The attack can be initiated remotely and the exploit has been publicly disclosed. The product uses rolling releases, so no version details are available.

An OS command injection vulnerability was found in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04, in an unknown function of hexstrike_server.py (Execute Endpoint component). Manipulating the code/script argument leads to command injection. The attack is possible remotely and the exploit has been disclosed publicly. The product uses rolling releases, so no version details are available.

An OS command injection vulnerability was found in GH05TCREW PentestAgent up to commit cf882dabea3ed91cef016cdd115e5426315665a2, in the LocalRuntime.execute_command function of runtime/runtime.py (LocalRuntime component). The manipulation leads to command injection. The attack may be performed remotely and the exploit has been published. The pull request to fix this issue awaits acceptance.

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. The vulnerability affects the run_task function in interface/main.py of the MCP HTTP Server component and allows OS command injection. The attack can be carried out remotely and the exploit is publicly available.

A stack-based buffer overflow was discovered in the camera of Samsung Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 mobile processors. It occurs when a malformed message is sent to the camera driver, causing a denial of service.

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

A double-free vulnerability was discovered in the MFC module of Samsung Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000 processors. The flaw in the Exynos MFC encoder driver, caused by improper cleanup of dma_buf references during error handling, leads to kernel memory corruption and potential arbitrary code execution.

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e.

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

In the MQTT-SN client (Zephyr, subsys/net/lib/mqtt_sn/mqtt_sn.c), process_ping() removes the gateway record after PINGREQ retries are exhausted, but the result of SYS_SLIST_PEEK_HEAD_CONTAINER is discarded, leaving gw as NULL. The code then dereferences NULL (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL) — triggering k_panic() with CONFIG_MEM_SLAB_POINTER_VALIDATE enabled, or corrupting the slab free list in the default configuration. The flaw is remotely triggerable by a malicious or compromised MQTT-SN gateway (or an on-path/adjacent attacker) that stops responding to PINGREQs.

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.