CVE Vulnerability Catalog

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary live_restreams_id values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.

A security flaw in aircheng-org iWebShop-5 up to 5.15 in the upload_json/uploadFile function of controllers/pic.php allows unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available. The project was informed but has not responded.

In affected Snowflake drivers, WORKLOAD_IDENTITY authentication attaches a cloud workload-identity token to the login request without verifying the configured host is a Snowflake endpoint. An attacker who can modify connection configuration can cause the token to be sent to a host they control. The captured token can be replayed to Snowflake for its remaining lifetime. On Azure, the token audience is also taken from connection configuration, potentially allowing access to non-Snowflake resources.

An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload.

An unencrypted 'pause encryption request' message causes a denial of service in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper.

The PayTR Virtual Pos iFrame API WHMCS Module contains an observable timing discrepancy vulnerability, allowing black box reverse engineering. The issue affects versions from v9.0.0 before v9.0.3.

The PayTR Virtual Pos iFrame API WHMCS Module contains a vulnerability due to improper validation of specified quantity in input, allowing input data manipulation. The issue affects versions from v9.0.0 before v9.0.3.

A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause a denial of service or disclose sensitive information. This issue affects Bifrost GPU Kernel Driver: from r12p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r19p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed memory. This issue affects Bifrost GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p3; Valhall GPU Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Userspace Driver: from r42p0 through r49p5, from r50p0 through r54p3, r55p0.

A vulnerability in aircheng-org iWebShop-5 up to 5.15 in the Update::index function of controllers/update.php leads to missing authorization. Remote exploitation is possible, and the exploit is publicly available. The project was informed but has not responded.

A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.

Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing valid GPU memory processing operations.

Use After Free vulnerability in Arm Ltd Bifrost, Valhall, and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing improper GPU memory processing operations.

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making the secret key easily obtainable via a bruteforce attack.

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command with an incomplete denylist.