CVE Vulnerability Catalog

laravel-backup-restore prior to version 1.9.4 allows OS command injection during database restore from a crafted backup archive. An attacker can exploit this by providing a malicious archive.

nebula-mesh prior to version 0.3.8 has a vulnerability in the web handler renderMobileBundle that passes the real *pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a *pki.CAManager, but Build never calls CAManager.Wipe() on any return path. As a result, when a mobile-bundle request goes through the web UI and Build returns (especially on error), the plaintext CA private key remains on the Go heap, unwiped, until garbage collection. An attacker able to read process memory can recover the CA signing key, allowing minting arbitrary host certificates for the mesh.

nebula-mesh prior to version 0.3.8 stores operator session tokens in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication.

Amazon EFS CSI Driver before v3.4.1 has a vulnerability in the volume deletion component where unverified ownership of a storage access point might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized to access, via a crafted PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem.

jofpin trape 2.0 has a weakness in the file core/user.py where manipulation of the argument vId/id causes authorization bypass. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The project was informed but has not responded yet.

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes.

A vulnerability in the DirectIo64.sys driver of PassMark products (PerformanceTest, BurnInTest, OSForensics) before specified versions allows an unprivileged local user to read all physical memory via a single IOCTL without caller identity check. The handler writes a crash-dump-format image of physical memory to a caller-supplied file path in SYSTEM context, enabling file creation in restricted locations and recovery of other processes' memory. The header exposes kernel module list, process list, and PFN pointers defeating KASLR, and a missing NULL check on an internal locator can cause a kernel crash.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist or port validation on exposed IOCTLs. Attackers can obtain a device handle and write to sensitive ports including PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, causing immediate system reset or other hardware-level manipulation from a standard user account.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations to enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to an attacker-chosen physical address.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions contains hard-coded credentials that allow local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded as a hardcoded literal and computing valid MD5 authentication tags for arbitrary IOCTL write requests. Attackers can also bypass a secondary validation gate by using the driver's own bit-clear IOCTL to clear a single bit in the gating instruction's displacement byte, causing all subsequent write requests to skip MAC verification, size checks, and Vendor ID checks entirely.

A vulnerability in the DirectIo64.sys driver of PassMark products before specified versions allows local users to clear arbitrary bits at any physical memory address due to missing validation of the physical address parameter in an exposed IOCTL handler. Attackers can obtain a device handle and supply an arbitrary 64-bit physical address with a bit index to invoke MmMapIoSpace and clear bits in kernel code pages or page table entries, enabling local privilege escalation or system compromise.

A vulnerability in the DirectIo64.sys kernel driver of PassMark products before specified versions is due to improper access control, as the device object is created without a security descriptor. Unprivileged local users can open a handle to the device and issue IOCTLs through the permissive default Windows ACL, gaining access to restricted hardware operations regardless of privilege or integrity level.

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file.

A vulnerability in Nango before 0.71.6 is due to missing authentication in the runner tRPC server, allowing unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

A SQL injection vulnerability in ILIAS before versions 9.22, 10.10, and 11.3 exists in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

SolidInvoice prior to version 3.0.1 contains a deserialization vulnerability in the DataGrid LiveComponent, where a writable context prop is deserialized with PHP's unserialize(). An authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to code execution.

PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.