CVE Vulnerability Catalog

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary OS commands.

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary OS commands.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks. Attackers can exploit the gateway's authentication filter, which only validates JWT parsing without verifying user roles or caller identity, and leverage a hardcoded JWT signing key embedded in publicly available JARs to forge tokens and escalate privileges from a low-privilege user to administrator, enabling cross-tenant data pollution and persistent backdoor access.

PowSyBl (Power System Blocks) prior to 7.2.2 contains a command injection vulnerability in UnixLocalCommandExecutor and WindowsLocalCommandExecutor, which concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping. Attacker-controlled values reaching UnixLocalCommandExecutor.execute, WindowsLocalCommandExecutor.execute, LocalComputationManager.execute, ParallelLoadFlowActionSimulator.run, ActionSimulatorTool.run, AmplModelRunner.run, or AmplModelRunner.runAsync can break out of the intended command and execute arbitrary shell commands as the JVM user. The affected itools paths include action-simulator with task-count, security-analysis with external, and dynamic-security-analysis. Downstream CLI tools, libraries, REST front ends, and multi-tenant grid-analysis services that forward less-trusted contingency identifiers or computation parameters into these APIs can expose the injection remotely. This issue is fixed in version 7.2.2.

phpSysInfo prior to 3.4.6 contains a vulnerability in the PSI_ALLOWED access-control check in read_config.php, which trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

Yamcs prior to 5.11.13 contains a vulnerability in StaticFileHandler.locateFile, which resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

Yamcs before versions 5.12.8 and 5.13.2 omits authorization checks in several API endpoints such as IndexesApi, Cop1Api, and TimeApi. An authenticated low-privilege user can read packet and event metadata, alter COP-1 link state, and manipulate simulation time.

Protego before version 0.6.2 translates every asterisk in Allow or Disallow directives into a lazy regex wildcard, causing exponential backtracking with many asterisks. Processing a crafted robots.txt can cause long URL matching and denial of service.

WsgiDAV before version 4.3.5 includes a sample MySQLBrowserProvider that concatenates record keys from request URLs directly into SQL WHERE clauses. An attacker with access to a share configured with this non-default provider can inject SQL via a normal GET request.

Piccolo Admin before version 1.14.0 allows non-superusers to perform GET requests on user and session tables, and the session token is not secret. A non-superuser administrator can obtain another user's session token and impersonate a superuser.

ALOS HTTP before version 0.0.0-20260617230736-314b6783e196 has a bug in sanitizeRequestPath that does not check if the path after splitting is empty. Sending a request with a question-mark-only path can cause an out-of-bounds panic and terminate the server process.

Bifrost before version 1.5.17 incorrectly classifies addresses from CGNAT, 6to4, NAT64, and fec0::/10 ranges as public. An attacker controlling a multimodal request URL can make the gateway fetch internal services, including cloud instance metadata.

MariaDB Connector/Node.js before versions 3.3.3, 3.4.6, and 3.5.3, when SSL is enabled without a pinned CA or server certificate, sends credentials before completing certificate fingerprint validation. An active man-in-the-middle can capture the database password.

KubeVela before versions 1.9.14, 1.10.9, and 1.11.0-alpha.4 has a vulnerability in the Terraform remote configuration loader. A user with permission to create or update ComponentDefinition can point terraform.path to /dev/zero, causing an unbounded read and memory exhaustion.

Vikunja before version 2.4.0 has a vulnerability in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint. Authorization only checks the project, view, and bucket from the URL, but does not check task permissions, allowing an authenticated user to read and modify tasks from other tenants.

Vikunja from version 0.24.6 to 2.4.0 has a vulnerability in the DELETE /api/v1/projects/:project/views/:view endpoint. An authenticated user can supply a view identifier from another project while authorization only checks the project identifier, allowing deletion of Kanban assignments and task ordering in other tenants.

dd-trace-rs is a Datadog library for application performance monitoring in Rust. From version 0.1.0 to 0.3.3, the parsing of the W3C tracestate header in tracecontext.rs collects all semicolon-separated key-value pairs from the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in version 0.3.3.

Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.