CVE Vulnerability Catalog

A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privileges to access sensitive information, which could be used to gain further access to network services.

A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct a denial of service attack, potentially crashing the system, preventing it from rebooting without manual intervention, and disrupting network operations.

Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. An unauthenticated remote attacker could send specially crafted packets to the affected service, potentially affecting its integrity and availability.

A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with high privileges could escalate privileges beyond their authorized level and execute arbitrary code on a vulnerable system.

Vulnerability in Oracle Siebel CRM Deployment (component: Cloud Gateway) affecting versions 17.0-26.7. A low privileged attacker with network access via HTTP can exploit it, resulting in unauthorized creation, deletion or modification of data as well as unauthorized access to critical data.

Vulnerability in Oracle Web Applications Desktop Integrator (component: File download) affecting versions 12.2.3-12.2.15. A low privileged attacker with network access via HTTP can easily exploit it, resulting in unauthorized access to critical data or complete access to all accessible data.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching. Consequently, a cookie for example.com can be sent to an attacker-controlled hostname such as evilexample.com.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values due to parallel or retried requests, the stored counter remains below the accepted maximum, allowing a passive observer to replay a captured Authorization header multiple times.

Vulnerability in Oracle Enterprise Manager Base Platform (component: Event Management) affecting versions 13.5 and 24.1. A low privileged attacker with network access via SOAP can easily exploit it, resulting in unauthorized creation, deletion or modification of critical data.

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component. The vulnerability can be exploited to inject malicious script.

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection.

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action. An authenticated user with Edit Page Multilingual Settings permission on a single page could bind an arbitrary page in another locale as that source page's translation and delete legitimate translation pairs, altering public-facing language routing.

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery. The vulnerability can be exploited for privilege escalation and lateral movement.

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters. The vulnerability compromises the confidentiality of stored credentials.

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Joomla Extension J2Store in versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 reflects unescaped request data into the PayPal notify redirect. A crafted link to the paypal notify endpoint, if followed by a victim's browser, causes the redirect to com_j2store's checkout controller to carry attacker-chosen query parameters.

Joomla Extension J2Store in versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 uses a predictable/forgeable order access token. Anyone who obtains the site's Joomla secret can compute a valid access token for any order without placing one, gaining guest access to order details and digital downloads.

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The activate_files() action created PageTemplate records from attacker-supplied values without validating an anti-CSRF token. A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session, changing site configuration without consent.

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could continue to mint valid access tokens after being deactivated or suspended (uIsActive=0), so deactivating an account did not revoke its API access.