CVE Vulnerability Catalog

An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. Remote attackers can exploit the vulnerability to access resources which are not otherwise accessible without proper authentication. Fixes are available in QTS 5.2.7.3297 build 20251024 and later, QuTS hero h5.2.7.3297 build 20251024 and later, and QuTS hero h5.3.1.3292 build 20251024 and later.

DeepChat before version 0.5.3 contains an XSS vulnerability in the Mermaid diagram rendering component, which escalates to full Remote Code Execution (RCE) due to the exposure of the Electron IPC renderer to the DOM. An attacker can execute arbitrary system commands.

Weblate before version 5.15 allows accepting an invitation opened by a different user. Version 5.15 contains a patch.

NanoMQ before version 0.24.4 has a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions. This is fixed in version 0.24.4.

TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).

Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal information from the database.

GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application. Attackers can overwrite the preset name with 260 'A' characters to trigger a buffer overflow and cause application instability.

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.

Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.

MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process.

In grav before 1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.

W OpenShift GitOps znaleziono lukę, która pozwala administratorom przestrzeni nazw na tworzenie niestandardowych zasobów ArgoCD, co może prowadzić do przyznania podwyższonych uprawnień w innych przestrzeniach nazw, w tym w przestrzeniach uprzywilejowanych. Uwierzytelniony atakujący może wykorzystać te uprawnienia do tworzenia uprzywilejowanych obciążeń działających na węzłach głównych, co skutkuje dostępem root do całego klastra.

Wtyczka Fox LMS – WordPress LMS Plugin dla WordPressa jest podatna na eskalację uprawnień we wszystkich wersjach do 1.0.5.1 włącznie. Problem wynika z niewłaściwej walidacji parametru 'role' podczas tworzenia nowych użytkowników przez punkt końcowy REST API `/fox-lms/v1/payments/create-order`.

A vulnerability was detected in Shiguangwu sgwbox N3 2.0.25 in the file /usr/sbin/http_eshell_server in the WIRELESSCFGGET interface. Manipulation of the argument params leads to buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in Shiguangwu sgwbox N3 2.0.25 in the file /usr/sbin/http_eshell_server in the WIREDCFGGET interface. Manipulation of the argument params leads to buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was detected in Shiguangwu sgwbox N3 2.0.25 in the file /usr/sbin/http_eshell_server in the DOCKER feature. Manipulation of the argument params leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in Shiguangwu sgwbox N3 2.0.25 in the file /usr/sbin/http_eshell_server in the NETREBOOT interface. Manipulation of the argument params leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in Shiguangwu sgwbox N3 2.0.25 in the SHARESERVER feature. Manipulation of the argument params leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

W urządzeniu Tenda WH450 w wersji 1.0.0.18 odkryto lukę bezpieczeństwa w nieznanej funkcji pliku /goform/DhcpListClient komponentu obsługi żądań HTTP. Manipulacja argumentem 'page' prowadzi do przepełnienia bufora na stosie.

The authentication mechanism on the web interface is not properly implemented. It is possible to bypass authentication checks by crafting a POST request with new settings since there is no session token or authentication in place. This would allow an attacker to point the device to an arbitrary address for domain name resolution, e.g., to facilitate a man-in-the-middle (MitM) attack.