CVE Vulnerability Catalog

Incorrect access control in the setNtpCfg function of TOTOLINK T6 allows unauthenticated attackers to alter time synchronization settings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud firmware download state information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify language configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

Pardus Boot Repair (TÜBİTAK BİLGEM product) has an OS command injection vulnerability due to improper neutralization of special elements. Affects versions from 1.0.7 before 1.0.8.

KitLogistic (TBC Technology Inc. product) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Affects versions before v2.2.2.

The Site Management Panel (Ankara Hosting) has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. Affects versions through 15062026.

In the Qute template engine (used by Quarkus), the ReflectionValueResolver component fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence template text can exploit this bypass to take control of the server by executing unauthorized commands.

A vulnerability in Apache Wicket allows bypassing file size and count limits when a multipart request has already been consumed by another component. Wicket then reads uploads via HttpServletRequest#getParts() without applying per-file and file-count limits, allowing larger or more numerous files than permitted. Additionally, a part without a Content-Type header is fully read into memory, potentially causing excessive resource consumption.

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.

A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

HTML::FormFu through version 2.08 for Perl allows resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. The repeat count is not limited, leading to deep cloning of element subtrees and memory/CPU exhaustion.

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised.

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.