CVE Vulnerability Catalog

In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-editfile method in /cgi-bin/wwwugw.cgi has an issue that allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. This can lead to unauthorized modification of device configuration.

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts.

An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods (ugw-ping, ugw-traceroute) that are not exposed in the web UI, allowing attackers to obtain sensitive information.

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.

In MBS-Solutions X-Serie Gateway firmware version V6_00_05, the ugw-deviceinfo method in /cgi-bin/wwwugw.cgi returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role. This is an information disclosure vulnerability.

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response.

IBM QRadar versions 7.5.0 through 7.5.0 UP15 Interim Fix 005 contain hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Hard-coded credentials can be discovered and exploited by an attacker.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7, could allow a local attacker to obtain sensitive information due to improper logging of database credentials. Logs may contain passwords or other confidential data.

IBM MQ Agent CD versions v1.0.0, v1.0.1, v2.0.0, v2.0.1 allow an authenticated user with a valid session cookie to submit arbitrarily large or computationally expensive requests that hold LLM agent workers for extended periods — from tens of seconds to over ten minutes per request. When multiple such requests are sent concurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users to experience degraded performance or complete unavailability of the AI Agent feature.

IBM Langflow OSS versions 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links. An attacker could exploit this flaw to read files they should not have access to.

IBM Langflow OSS versions 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. An attacker can send requests to internal network resources, potentially leading to data disclosure.

IBM Langflow OSS versions 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. An attacker can manipulate file paths to access files outside the allowed directory.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about processes they shouldn't be permitted to access.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint.

IBM Langflow OSS versions 1.0.0 through 1.11.2 allow remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).

IBM Langflow OSS versions 1.0.0 through 1.11.2 could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker-controlled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with low-privileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

IBM Langflow OSS versions 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files.