CVE Vulnerability Catalog

Model legacy Ksenia Security lares w wersji 1.6 zawiera podatność na domyślne dane uwierzytelniające, która umożliwia nieautoryzowanym atakującym uzyskanie dostępu administracyjnego. Atakujący mogą wykorzystać słabe domyślne dane administracyjne, aby przejąć pełną kontrolę nad systemem automatyki domowej.

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrative credentials.

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.

JM-DATA ONU JF511-TV w wersji 1.0.67 wykorzystuje domyślne dane logowania, co pozwala atakującym na uzyskanie nieautoryzowanego dostępu do urządzenia z uprawnieniami administratora.

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with a path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution.

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user interaction.

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.

MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

In matio 1.5.28, a heap-based memory corruption issue was found in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption. NOTE: Multiple third-parties note that the available evidence does not demonstrate a vulnerability exploitable through an attacker-controlled input path.

Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

JD Cloud NAS routers AX1800, AX3000, AX6600, BE6500, ER1, and ER2 in specific firmware versions contain an unauthorized remote command execution vulnerability. An attacker can exploit this flaw without authentication, leading to full device compromise.

Podatność typu Cross-Site Request Forgery (CSRF) w ConoHa przez GMO WING WordPress Migrator umożliwia przesyłanie powłok sieciowych na serwer WWW. Problem dotyczy WING WordPress Migrator w wersjach od n/a do 1.2.0 włącznie.

W podatności CVE-2025-15255 zidentyfikowano problem w urządzeniu Tenda W6-S 1.0.0.4(510), który dotyczy nieznanej funkcji pliku /bin/httpd komponentu R7websSsecurityHandler. Manipulacja argumentem Cookie może prowadzić do przepełnienia bufora na stosie.

In the Linux kernel, the RDMA/irdma module has a data race on the cqp_request->request_done field. The field is read without locking in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. The issue was fixed by using READ_ONCE/WRITE_ONCE macros to prevent compiler optimizations and KCSAN warnings.

In the Linux kernel, there is a race condition in the CIFS filesystem when connecting to an IPC tree. Access to the hostname field in TCP_Server_Info is not properly protected, which can lead to it being freed in the cifsd thread and cause a use-after-free in __tree_connect_dfs_target().

In the Linux kernel, there is a double free of the xprt_ctxt pointer in the SUNRPC service. When an RPC request is deferred, the pointer is moved to svc_deferred_req, but on a second deferral it is not cleared, leading to double free or adding to a free list, which can cause an oops.

A vulnerability in the Linux kernel's CIFS module can cause a system crash (oops) during oplock break handling. The issue stems from a race between deferred close and lease breaks, potentially leading to an invalid pointer dereference during filesystem unmount.

A vulnerability was found in the Linux kernel's SMC (Shared Memory Communications) module. The smc_llc_srv_add_link() function lacked proper protection, which could lead to a race condition and result in a system panic (crash) when the server attempts to create a second link.