CVE Vulnerability Catalog

In DataEase versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://, but omission of protection for the dns:// protocol results in an SSRF vulnerability. The issue is fixed in version 2.10.15.

Youki, a Rust-based container runtime, in versions 0.5.6 and below performs insufficiently strict write-target validation in AppArmor handling. Combined with path substitution during pathname resolution, this can allow writes to unintended procfs locations. While resolving a path component-by-component, a shared-mount race can substitute intermediate components and redirect the final target. Fixed in 0.5.7.

Youki, a Rust-based container runtime, in versions 0.5.6 and below has insufficient initial validation of the /dev/null source. This allows container escape when Youki bind-mounts the container's /dev/null as a file mask. Fixed in 0.5.7.

Tonec Internet Download Manager 6.42.41.1 and earlier fails to validate SSL certificates, allowing attackers to bypass update protections.

Dell CloudLink versions prior to 8.1.1 contain a vulnerability where a privileged user with a known password can exploit a CLI escape to gain control of the system. The issue affects versions older than 8.1.1.

Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system. If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password.

A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions for script creation and execution. This is due to improper authentication mechanisms in the communication between the CCX Editor and the Unified CCX server.

A vulnerability in the Java RMI process of Cisco Unified CCX is due to improper authentication mechanisms associated with specific features. An unauthenticated remote attacker could upload a crafted file and execute arbitrary commands with root privileges.

A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to arbitrary code execution.

Control-M/Agent jest podatny na zdalne wykonanie kodu bez uwierzytelnienia, nieautoryzowany odczyt i zapis plików oraz podobne działania, gdy mutualne uwierzytelnianie SSL/TLS nie jest włączone (tj. w domyślnej konfiguracji).

Wtyczka KiotViet Sync dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu braku walidacji typu pliku w funkcji create_media() we wszystkich wersjach do i włącznie z 1.8.5. Umożliwia to nieautoryzowanym atakującym przesyłanie dowolnych plików na serwerze dotkniętej witryny.

Wtyczka AI Engine dla WordPressa jest podatna na ujawnienie wrażliwych informacji we wszystkich wersjach do 3.1.3 włącznie, poprzez punkt końcowy REST API /mcp/v1/, który ujawnia wartość 'Bearer Token' przy włączonym 'No-Auth URL'.

The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into the evaluate() function and trigger arbitrary code execution.

Mantis Bug Tracker (MantisBT) versions 2.27.1 and below use loose (==) instead of strict (===) comparison in authentication code. PHP type juggling causes certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using MD5 login allow an attacker who knows the victim's username and has access to an account with a password hash evaluating to zero to log in without knowing the victim's password, using any other password with a hash also evaluating to zero. Fixed in 2.27.2.

The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check.

Radiometrics VizAir lacks authentication mechanisms for critical functions such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and meteorological data, misleading air traffic control and pilots.

Radiometrics VizAir is vulnerable to any remote attacker accessing the admin panel without authentication. The attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, potentially disabling vital alerts and manipulating runway assignments.

Radiometrics VizAir exposes the system's REST API key through a publicly accessible configuration file. Attackers can remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data.

Wtyczka Easy Upload Files During Checkout dla WordPressa jest podatna na przesyłanie dowolnych plików JavaScript z powodu braku walidacji typu pliku w funkcji 'file_during_checkout' we wszystkich wersjach do 2.9.8 włącznie. Umożliwia to nieautoryzowanym atakującym przesyłanie dowolnych plików JavaScript na serwer dotkniętej witryny.

The ShopLentor plugin for WordPress in versions up to and including 3.2.5 is vulnerable to Local File Inclusion via the 'load_template' function. An unauthenticated attacker can include and execute arbitrary .php files on the server, leading to PHP code execution.