CVE Vulnerability Catalog

In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.

A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.

An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.

An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.

A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.

A vulnerability in Logsign SIEM allows an attacker to use default or common usernames and passwords. The issue affects versions from 6.4.101 before 6.4.117.

A vulnerability in Canonical LXD (versions 4.0 and later, fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) allows an authenticated client or a malicious migration source server to write attacker-controlled files to arbitrary paths on the host as root, leading to full host compromise. The attack uses a crafted rsync or btrfs send stream that plants a symlink in the transferred volume.

A path traversal vulnerability in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root. The attack uses a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

A path traversal vulnerability in the btrfs storage driver in Canonical LXD (versions 4.0.2 and later, fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) allows an authenticated client with permission to create instances to delete arbitrary files on the host as root. On hosts with btrfs root filesystem, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise.

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can send a GET request with the file path parameter set to any path, including an absolute local file path. This issue was fixed in version V4.

Dayforce ESS Excelity is vulnerable to Time-Based Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare a GET request with one of the parameters filled in with an arbitrary SQL query, which is interpreted as part of an SQL predicate. This issue was fixed in version V3.

A vulnerability was identified in Netcore NR289-GE 1.4.5102 in the system function of the file /ap_ip.cgi of the CGI Handler component. Manipulation of the argument ip leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.

Google Cloud Application Integration versions prior to 2026-06-28 contain a Deserialization of Untrusted Data vulnerability in the JavaScript task. An authenticated user with standard permissions can run arbitrary code on shared production servers by bypassing parameter guards with a specially crafted script.

Google Cloud Application Integration versions prior to 2026-06-17 contain an Incorrect Authorization vulnerability in task configuration. An authenticated Google Cloud user can execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.

A vulnerability was identified in FAST FAC1900R version 20190827_2.0.2.2 in the copy_msg_element function of the devdiscover Service component. Manipulation leads to a stack-based buffer overflow, and the attack can be executed remotely. The exploit is publicly available and may be used; the vendor did not respond to the disclosure.

A vulnerability was determined in FAST FAC1200R version 5.0_20201119_1.0.2 in the MmtAtePrase function of the MmtAtePrase Parser component. Manipulation causes a stack-based buffer overflow, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.

A vulnerability was found in FAST FAC1200R version 5.0_20201119_1.0.2 in the parse_advertisement_frame function of the devdiscover Service component. Manipulation results in a stack-based buffer overflow, and the attack may be launched remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

Apache Roller 6.1.5 contains a Deserialization of Untrusted Data vulnerability because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is disabled; no non-default configuration is required. This can lead to remote code execution.

Apache Roller 6.1.5 contains an Incorrect Authorization vulnerability in the OAuth 1.0a authorization endpoint. An unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer can bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session.