CVE Vulnerability Catalog

A vulnerability in brace-expansion up to version 5.0.6 allows a DoS attack by sending a crafted string with many consecutive non-expanding '{}' brace groups. The expand() function has exponential time complexity, causing high CPU consumption and event-loop blocking.

The vulnerability in PROMOD V is due to the use of insecure HTTP instead of HTTPS. The issue originates from the Digipede server lacking HTTPS support.

A vulnerability in Nokia MantaRay NM allows a local attacker with local admin privileges to escalate to full root privileges on the host. Successful exploitation results in root-level filesystem access and the ability to execute actions as root.

Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.

The vulnerability allows deserialization of untrusted data, which may enable an attacker to execute arbitrary code.

The DGM3103SCT device from AVTECH Security Corporation contains an OS command injection vulnerability. A user who can log in to the web management console can execute arbitrary commands with root privileges.

RPG MAKER MV and MZ from Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. Loading a specially crafted save file may execute arbitrary OS commands.

A double free vulnerability has been found in libarchive's RAR5 reader. During processing of a specially crafted RAR5 archive, the filtered_buf pointer may become stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition.

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to and including 2.2.6. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The WP Support Plus Responsive Ticket System WordPress plugin up to version 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

The WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2 fails to properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

A vulnerability in the rtapi_app component of the linuxcnc-uspace package in LinuxCNC before version 2.9.9 allows privilege escalation. The program is installed SUID root and loads shared library modules via dlopen() using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library, and because the process retains elevated privileges during module loading, this results in local privilege escalation to root.

The HTTP server in Zephyr (subsys/net/lib/http) is vulnerable to path traversal in the static filesystem resource handler (HTTP_RESOURCE_TYPE_STATIC_FS). An attacker can send a GET request with ../ sequences in the URL path to read arbitrary files outside the configured root directory. Affects versions v4.0.0 through v4.4.0 when file system support (CONFIG_FILE_SYSTEM) is enabled.

A vulnerability in Zephyr RTOS affects IPv6 Neighbor Discovery handlers. Incorrect boolean logic causes all RFC 4861 validity checks (including the mandatory Hop Limit == 255) to be bypassed when the ICMPv6 code field is 0 (normal for ND). This allows an attacker to inject forged RA/NS/NA messages.

A heap buffer overflow vulnerability has been discovered in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 versions 2.3.3 through 2.3.6. An attacker can exploit this to cause a Denial of Service (DoS) by sending a crafted payload.

A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.

A buffer overflow vulnerability in the Get_Attribute_List function of EIPStackGroup OpENer (commit 76b95c) allows an attacker to cause a Denial of Service (DoS) by sending a crafted Common Packet Format (CPF) packet.

In Coolify prior to version 4.0.0-beta.471, server and project lookups are not scoped to the current team. An authenticated user can access servers and projects belonging to other teams by specifying their IDs directly.

A missing critical step in authentication was found in Apache Tomcat's JNDIRealm when configured to use GSSAPI. Attackers can authenticate without providing the correct password.

An Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve causes subsequent non-OR conditions to be skipped if the first condition in an OR chain matches.