CVE Vulnerability Catalog

Istnieje podatność na wstrzykiwanie poleceń systemowych z powodu niewłaściwej walidacji danych wejściowych. Aplikacja akceptuje parametr bez weryfikacji, czy jest to prawidłowy adres IP, co może umożliwić atakującemu wstrzyknięcie dowolnych poleceń.

Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.

Nieprawidłowe neutralizowanie specjalnych elementów używanych w poleceniach systemowych ('iniekcja poleceń') w Cursor umożliwia nieautoryzowanemu atakującemu wykonywanie poleceń spoza dozwolonej listy, co prowadzi do wykonania dowolnego kodu.

FAST FAC1200R router (F400_FAC1200R_Q) is vulnerable to buffer overflow in function sub_80435780 via the string parameter fac_password.

FAST FAC1200R router (F400_FAC1200R_Q) is vulnerable to buffer overflow in function sub_80435780 via the password parameter.

Apache Druid uses a weak fallback secret for its Kerberos authenticator when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not set. The secret is generated using `ThreadLocalRandom`, which is not cryptographically secure. Additionally, each process generates its own secret, leading to inconsistencies across nodes and authentication failures.

FACTION (a PenTesting Report Generation and Collaboration Framework) before version 1.7.1 allows arbitrary code execution on the server via the extension execution path. Missing authentication on the `/portal/AppStoreDashboard` endpoint allows an unauthenticated attacker to upload a malicious extension, leading to remote code execution.

The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the config path of the service to a command; starting and stopping the service to immediately achieve code execution and privilege escalation.

Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Tar extraction with -C / allowing arbitrary file overwrite via crafted archive. The restore_mozzi_memories.sh script extracts user-controlled tar archives with -C / flag, depositing contents to the filesystem root without path validation. When combined with unauthenticated file upload vulnerabilities, attackers can craft malicious .tgz archives containing path-traversed filenames to overwrite critical system files.

Unauthenticated OS Command Injection in restore_settings.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec() allowing remote code execution. The endpoint passes user-controlled $_GET["name"] through urldecode() directly into exec() without validation or escaping, enabling arbitrary shell command injection via metacharacters.

Authenticated root remote code execution via improper user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php where user-supplied data/hour/time is passed directly into the date shell command.

Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform the deletepatch parameter allows unauthenticated deletion of arbitrary files. The deletepatch parameter in patch_contents.php allows unauthenticated deletion of arbitrary files in /var/www/patch/ directory without sanitization or access control checks.

Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform unrestricted file upload in patch_contents.php, allowing uploading malicious files. The /var/tdf/patch_contents.php endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.

An unauthenticated attacker can upload arbitrary files to the upgrade_contents.php endpoint in Mozart FM Transmitter. Missing signature validation allows malicious firmware injection, potentially leading to remote code execution.

An unauthenticated attacker can use the deleteupgrade parameter in upgrade_contents.php to delete arbitrary files in /var/www/upload/ without extension or path sanitization, potentially removing critical system files.

The start_upgrade.php endpoint passes user-controlled filename directly to exec() without sanitization. An unauthenticated attacker can inject arbitrary shell commands, achieving remote code execution as the web server user (likely root).

An unauthenticated attacker can exploit the deletehidden parameter to perform path traversal and delete arbitrary .tgz files on the Mozart FM Transmitter.

An unauthenticated attacker can upload arbitrary files via /var/tdf/status_contents.php in Mozart FM Transmitters. This allows remote code execution or full device compromise.