CVE Vulnerability Catalog

ASUS Armoury Crate has a vulnerability related to a permissive list of allowed inputs, allowing a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by bypassing the validation mechanism.

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections. This allows an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

A vulnerability has been found in Edimax BR-6478AC V2 1.23, affecting the function formWlSiteSurvey in the file /goform/formWlSiteSurvey. Manipulation of the argument selSSID leads to buffer overflow, allowing for remote attack.

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

Craft CMS versions from 5.5.0 to 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method. This allows an authenticated admin user to inject Yii2 event handlers, leading to the execution of arbitrary PHP code and disclosure of sensitive information.

Capgo versions before 12.128.2 contain an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

Capgo before 12.128.2 contains an unauthenticated RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys. This creates an API key validity oracle and user identity disclosure primitive.

Capgo before version 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER function, which performs sensitive billing operations without enforcing internal authorization checks. The function runs with the owner's privileges, bypassing Row Level Security.

The vulnerability in picklescan before version 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to bypass scanning and execute arbitrary code when a malicious pickle file is loaded via pickle.load().

A vulnerability in picklescan before version 0.0.30 allows bypassing detection of malicious pickle files. Attackers can use the idlelib.pyshell.ModifiedInterpreter.runcommand method in reduce functions to hide code that executes remote commands when the file is loaded by the victim.

Picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands.

The vulnerability in picklescan before version 0.0.28 fails to detect malicious pickle files that invoke the torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.

A vulnerability was determined in BerriAI litellm up to version 1.82.2, affecting the function json.dumps in the file litellm/proxy/management_endpoints/ui_sso.py of the SSO Debug Flow component. Manipulating this function can lead to missing authentication.

A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to version 9.76, affecting some unknown functionality in the library bootpt64.sys of the Kernel Driver component. Manipulation leads to improper access controls.

In the Linux kernel, a vulnerability in ksmbd was found where the conn->binding flag remained set after SESSION_SETUP, allowing global session lookup for connections not bound to that session. The fix tightens the global lookup to require the session to have the connection registered in its channel xarray.

A weakness has been identified in IM-Magic Partition Resizer up to version 7.9.0, affecting an unknown function in the MDA_NTDRV.sys library of the Kernel Driver component. This manipulation causes improper access controls.

A security flaw has been discovered in EaseUS Partition Master up to version 14.5, concerning an unknown function in the library EUEDKEPM.sys of the Kernel Driver component. Manipulation of this flaw results in improper access controls.

A vulnerability was identified in EaseUS Partition Master up to version 14.5, concerning an unknown function in the library epmntdrv.sys of the Kernel Driver component. Manipulation leads to improper access controls.

A vulnerability was detected in AOMEI Backupper up to version 8.3.0, concerning an unknown function in the library amwrtdrv.sys of the Kernel Driver component. Executing a manipulation can lead to improper access controls.

A vulnerability was found in AOMEI Dynamic Disk Manager up to version 10.10.1, affecting some unknown processing in the library ddmdrv.sys of the Kernel Driver component. Manipulating this element results in improper access controls.