CVE Vulnerability Catalog

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

Improper authorization in the SocketIO interface leads to remote code execution. The vulnerability allows an attacker to execute arbitrary code on the server.

The '/password/guardarClau/recover' endpoint accepts the 'usuariId' parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts.

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the handshake without validating the server's certificate. The attacker needs no certificate, private key, or prior session.

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded. The XS backend rejects the same label, causing inconsistency between installations.

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. No label length limit exists in the to-Unicode direction, allowing memory growth.

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. Some digit writes and the terminating NUL write do not check for room, leading to out-of-bounds writes.

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input. Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless another plugin or theme containing a POP chain is installed. Exploitation requires the "Allow Multiple Recipients" option to be enabled and the eCard "Custom Message" option to be disabled (the plugin default).

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: populate_via_query_string() unconditionally overrides the form's target object_id without authorization checks, and Form::process() lacks the user_can_edit() check, allowing unauthenticated attackers to overwrite any page's post_content with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode without role validation. The standalone plugins Meta Box Frontend Submission (up to 4.5.6) and Meta Box User Profile (up to 3.11.0) are also affected.

A vulnerability was detected in Gigatech PDV5701 version 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the WebSocket Service component, resulting in missing authentication. The attack can be launched remotely, and the exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

An issue in gray-matter all versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript. This allows arbitrary code execution.

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, allowing an authenticated project member who owns a TLS-enabled load balancer to embed a newline and inject arbitrary HAProxy configuration directives.

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, so newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora.

Remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function in Univer v1.0.0-alpha.2. Attackers can execute arbitrary code via a crafted payload.

Remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function in Univer v1.0.0-alpha.2. Attackers can execute arbitrary code via a crafted payload.

SQL injection vulnerability in the checkSQL function in nocobase v2.1.21. Attackers can access sensitive database information via injecting crafted SQL statements.

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root.

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox.