CVE Vulnerability Catalog

A vulnerability in the inets HTTP server in Erlang/OTP allows a remote unauthenticated attacker to read files in a mod_auth protected directory by prefixing the request path with an extra slash. URI normalization does not collapse double slashes, causing the path check to miss the protected directory.

The inets HTTP server in Erlang/OTP does not implement obs-fold (header continuation lines), which may lead to HTTP request smuggling vulnerabilities. Every CRLF followed by a non-CRLF starts a new header, which can be exploited by an attacker.

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this to execute arbitrary code with root privileges.

The httpc HTTP client in Erlang/OTP does not enforce a limit on the total size of response headers. The max_header_size option defaults to nolimit, allowing a malicious server to send an arbitrarily large number of headers, leading to unbounded memory allocation and potential BEAM VM crash.

A Cross-Site Request Forgery (CSRF) vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows unauthorized actions to be performed on behalf of an authenticated user.

A missing authentication for critical function vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows authentication bypass and access to administrative functions without logging in.

SQL injection vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. due to improper neutralization of special elements in SQL commands. Affects versions from V.4 before V.16.

Denial-of-service vulnerability in affected Logix platforms due to improper validation of input length during CIP message processing. Can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover.

Vulnerability in the Redundancy Module Configuration Tool (RMConfigTool.exe) where it searches system path directories for a required DLL, some of which may be writable by standard users due to incorrect default permissions. A local attacker can place a malicious DLL that gets loaded when an administrator runs the tool, executing with Administrator/SYSTEM privileges.

Vulnerability in the Redundancy Module Configuration Tool (RM3ConfigTool.exe) where it searches system path directories for a required DLL, some of which may be writable by standard users due to incorrect default permissions. A local attacker can place a malicious DLL that gets loaded when an administrator runs the tool, executing with Administrator/SYSTEM privileges.

Denial-of-service vulnerability in RSLinx Classic. A crafted CIP packet with an oversized embedded message request can crash the RSLinx Classic service, requiring a restart to recover.

Denial-of-service vulnerability in RSLinx Classic. A crafted CIP packet can crash the RSLinx Classic service due to insufficient data length validation, requiring a restart to recover.

A denial-of-service vulnerability exists in RSLinx Classic. A crafted CIP packet targeting the Forward Close service can crash the RSLinx Classic service, requiring a restart to recover.

A vulnerability in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows bypass of the denylist introduced for CVE-2018-1000130. Attackers can use alternative JMX URL forms such as ldaps://, leading to SSRF, forwarding of JMX credentials, and potentially remote code execution.

A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths. As a result, attacker-controlled Python code from custom_generate/generate.py is copied into the user's ~/.cache/huggingface/modules directory even if the user declines the trust prompt.

A Protection Mechanism Failure vulnerability in Dell PowerStore. An authenticated user with limited privileges could exploit this to bypass access restrictions and gain escalated privileges.

A Code Injection vulnerability in Dell PowerStore. An authenticated user with limited privileges could exploit this to execute arbitrary code with root privileges.

An OS Command Injection vulnerability in Dell PowerStore. An authenticated user with limited privileges could exploit this to execute arbitrary commands with root privileges.

Incorrect access control in the setDevReboot function of TOTOLINK T6 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via a crafted MQTT message to the cs_broker component.

An Arbitrary File Upload vulnerability in the Gravity Forms plugin for WordPress (up to and including 3.0.2). Insufficient validation of multi-file upload chunk state in GFAsyncUpload::upload() allows unauthenticated attackers, when a public form has a File Upload field with Multiple Files enabled, to upload a PNG/PDF polyglot to an attacker-selected public .php or .html filename in the temporary upload directory. This can lead to remote code execution on NGINX or other non-.htaccess respecting servers. Where PHP execution is blocked, attacker-written HTML can result in stored XSS.