CVE Vulnerability Catalog

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 expose unprotected REST API endpoints without authentication. A remote unauthenticated attacker can read sensitive device information such as network configuration, firmware details, and cloud service information, and can modify device configuration, including DNS settings.

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 have an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login. Submitting an empty or absent UserName parameter allows obtaining a valid administrative session without knowing the password, bypassing client-side JavaScript validation.

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).

Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU).

Reflected Cross-site Scripting (XSS) vulnerability in the aBlocks plugin by Kodezen LLC. Improper input neutralization during web page generation allows an attacker to inject malicious scripts.

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contain an OS command injection vulnerability in ImageOptimizer#identify_format. Attackers controlling the image path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.

The @enmaso/node-convert package through version 1.0.0 contains an OS command injection vulnerability in convert.js. Unsanitized filepath and convertTo arguments can be used to inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec(), allowing command execution with Node.js process privileges.

Prototype pollution vulnerability in the dot-access library up to version 1.0.0. An attacker controlling the path (e.g., via user-supplied field names) can use __proto__ segments to inject properties into all objects.

The dot-access library versions 0.0.3 through 1.0.0 contain a code injection vulnerability. The path supplied to get() is concatenated into a new Function body in index.js, allowing attackers to reach constructor.constructor to load child_process and run operating system commands in the Node.js process.

The ppt2png tool through version 0.0.6 contains an OS command injection vulnerability. Unsanitized input or output path arguments can be used to append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, allowing command execution with Node.js process privileges.

In music-metadata prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A truncated file containing only an ID3v2 header can request an allocation approaching 268 MiB; the allocation succeeds, the subsequent read reaches end of stream, the EndOfStreamError is caught internally, and the caller receives a normal metadata object.

Prior to version 11.16.0, the APEv2 parser in the music-metadata library reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before verifying that the declared size fits in the remaining data. A small crafted APE file can trigger a disproportionate allocation, and repeated or concurrent parsing can exhaust process memory. This issue is fixed in version 11.16.0.

In the amqp091-go library (Go AMQP 0.9.1 client) from version 1.13.0 to 1.14.0, the frame-size mitigation can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing memory allocation before the payload is received or the frame's protocol state is rejected. This issue is fixed in version 1.14.0.

Vulnerability in MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. When using the text protocol, escaping always prefixes quotes with a backslash and does not honor the NO_BACKSLASH_ESCAPES mode, allowing SQL injection via an attacker-controlled value.

Vulnerability in MariaDB Connector/Node.js from 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4. When permitSetMultiParamEntries is enabled, object keys are expanded into a SQL SET clause without being processed by escapeId, allowing SQL injection via a key containing a backtick.

Vulnerability in MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. The GeoJSON Polygon and MultiPolygon binary encoders allocate memory via Buffer.allocUnsafe() based on each ring's numeric length before confirming the ring is an array, potentially disclosing uninitialized Node.js heap data.