CVE Vulnerability Catalog

A hard-coded credentials vulnerability in the SSH service of Alpine iLX-F511 devices allows a network-adjacent attacker to execute arbitrary code. No authentication is required, enabling code execution with telechips user privileges.

The BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's declared length matches the actual byte range before copying it into a database command. An application processing untrusted bytes can emit a structurally inconsistent message, causing the database to interpret trailing content as additional command fields, potentially altering data read or written.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in tooltips of breadcrumb bar overflow menu entries. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted config.xml files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.

An injection vulnerability in the web server of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

An incorrect permission assignment for a critical resource in RoutingManager of Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials by triggering processes that write to the /tmp directory.

An injection vulnerability in the ember service of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart.

An out-of-bounds read vulnerability in the VRRP implementation of Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.

An out-of-bounds write vulnerability in TCP header processing of Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length.

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data. This can potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.

An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service. Exploitation occurs via a specially crafted HTTP request.

Xibo before 4.4.3 lacks authorization on POST /displaygroup/criteria/{displayGroupId}, allowing an authenticated user to send criteria updates to any display via XMR. These criteria affect scheduling and can alter playback. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks access-control checks on GET /layout/status/{id}, allowing an authenticated user with any privileges to view the status and metadata of any layout, including those they do not have view rights to. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks object-level authorization on /notification/export/{id}, allowing an authenticated user to download attachments from any notification, including those created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre, a privilege granted to non-administrators as standard. The issue is fixed in version 4.4.3.

The Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 did not verify ownership of the default query result location, potentially allowing remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. The issue is fixed in version 3.16.1.

GFI KerioConnect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

OpenVPN ovpn-dco-win versions 0.6.5 through 2.8.13 allow unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.