CVE Vulnerability Catalog

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators.

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations(). An authenticated attacker can insert access-right records for a caller-supplied target space without verifying the caller has rights to that space.

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability via the _idCategoryFilter parameter. The malicious payload is persisted into the session and later concatenated into a SQL statement without parameterization in app/Common/MdlCategory.php.

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability allowing attackers to predict temporary or default account passwords generated by Txt::defaultPassword(). The function relies on PHP's uniqid() based on server time in microseconds.

MultiTail version 7.1.5 and earlier contains a vulnerability in the execute-on-match feature (-ex and -eX) that appends attacker-controlled matched input to a configured command inside double quotes. Partial escaping leaves shell metacharacters such as command substitution active, allowing command execution via sh -c.

Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access.

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access.

Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system.

Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.

Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.

Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code, requiring the victim to run the application.

Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability, but exploitation requires user interaction — a victim must run the application. Scope is changed.

Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability, but exploitation requires user interaction — a victim must run the application. Scope is changed.

Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction — a victim must open a malicious file.

Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction — a victim must open a malicious file.

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction — a victim must open a malicious file.

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction — a victim must open a malicious file.

Substance3D - Stager is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation requires user interaction — a victim must open a malicious file.