CVE Vulnerability Catalog

Vulnerability in Yealink SIP-T46U version 108.86.0.118 in the Firmware Chunk Upload Handler component (mod_upgrade.SparePartsUpload function in /api/upgrade/accupgradebychunk). Manipulation of uid argument leads to stack-based buffer overflow. Attack requires local network access.

Vulnerability in Yealink SIP-T46U version 108.87.50.1 in the Web FastCGI Service component (StartReportInformation function in /api/inner/beforewifitest). Manipulation of port argument leads to stack-based buffer overflow. Attack requires local network access.

Vulnerability in the kernel driver dvdfabio.sys in DVDFab Virtual Drive 2.0.0.5. An unknown function in the library leads to improper privilege management. Local access required. Exploit has been published.

A security flaw was discovered in Qihoo 360 Total Security 6.0 affecting the RpcStringBindingComposeW function of the Nucleus Engine Monitoring Logic component. Manipulating the NetworkAddr argument leads to protection mechanism failure. The attack requires local access and the exploit has been publicly released.

A vulnerability was found in ShopXO up to version 6.7.1 in the functions OrderClose, OrderSuccess, PayLogOrderClose, and GoodsGiveIntegral in the file app/api/controller/Crontab.php of the Scheduled Task Endpoint component. Manipulation can lead to authorization bypass. The attack can be executed remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability has been detected in the libeay32.dll.html library of TinyWeb Server up to version 1.94 on Win32. The attack involves manipulating the Authorization argument in the Header Handler component. The exploit is publicly available and the vendor did not respond.

In Microweber up to 2.0.20, a path traversal vulnerability exists in the userfiles_path function of /api_nosession/thumbnail_img via manipulation of the cache_path_relative argument. The attack can be launched remotely and the exploit is publicly available.

Command injection in the nslookup function in /cgi-bin/luci/api/diagnose of Ruijie EG105G-P router. Manipulation of the params.target argument allows remote arbitrary command execution.

Vulnerability in the RevoDetector.sys driver of VS Revo RevoUninstaller 2.5.x/2.6.x allows a local attacker to trigger a heap-based buffer overflow via the IOCtl_Handler function. Exploit is publicly available.

A buffer overflow vulnerability has been found in the web server component of GALAYOU Y4 version 1.0.0. The attack is only possible from the local network. The exploit is publicly available and the vendor did not respond.

Vulnerability in Comma AI Openpilot 0.11 allows a local attacker to deserialize untrusted data via pickle.load/pickle.loads in modeld.py. This could lead to arbitrary code execution.

In GL.iNet GL-MT3000 up to version 4.4.5, a command injection vulnerability exists in the file /usr/bin/one_click_upgrade of the Online Firmware Upgrade Handler. The attack can be launched remotely. A public exploit is available.

In GL.iNet GL-MT3000 up to version 4.4.5, a command injection vulnerability exists in the replace_country function of the Tor Proxy Service Configuration Handler. The attack can be initiated remotely. A public exploit is available.

The driftregion iso14227 library (through 0.9.0) contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14227.c, allowing a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.

MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response function in src/mqtt.c. A remote unauthenticated attacker controlling an MQTT broker or able to inject MQTT traffic into an unencrypted session can crash a subscribed MQTT-C client and potentially disclose adjacent heap memory by sending a single crafted PUBLISH packet.

Off-by-one buffer overflow vulnerability in nanoMODBUS through v1.23.0 in the recv_msg_header function of the Modbus/TCP server. A remote unauthenticated attacker can write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame with the Length field set to 255.

Config::IniFiles for Perl before 3.001000 uses a two-argument open() for the -file argument, allowing OS command injection or file overwrite if the filename starts or ends with a pipe (|) or redirect (>).

A vulnerability in D-Link DCS-935L 1.10.01 affects the snprintf function in the file /web/cgi-bin/greece/rhea of the HTTP Handler component. Manipulation of the data argument leads to a format string vulnerability. The attack can be launched remotely, and the exploit has been publicly disclosed.

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.