CVE Vulnerability Catalog

Vulnerability in Arista EOS with IPsec configured. A specially crafted packet can stop all IPsec traffic processing in the dataplane. After reset, traffic may not resume. Non-IPsec traffic is unaffected.

In Shibby Tomato 1.28.0000, the Web UI component's start_6rd_tunnel function in /sbin/rc is vulnerable to OS command injection via the ipv6_6rd_borderrelay argument. The attack can be launched remotely and the exploit has been made public.

In Shibby Tomato 1.28.0000, the Web UI component's start_dhcpc function in /sbin/rc is vulnerable to OS command injection. The attack can be initiated remotely and the exploit has been published.

Iris (DFIR-IRIS) before version 2.4.28 exposes an optional GraphQL endpoint at `/graphql` without proper authorization checks. An authenticated user can read IOCs from other cases (IDOR), disclose all IOCs in a case, and create unauthorized cases.

Chartbrew to aplikacja webowa typu open-source, która umożliwia łączenie się z bazami danych i API w celu tworzenia wykresów. W wersjach od 4.9.0 do 5.0.0, uwierzytelniony użytkownik z uprawnieniami edytora projektu może przechowywać dowolny kod HTML/JavaScript w polu `ChartDatasetConfig.legend`, co prowadzi do wstrzyknięcia złośliwego kodu do elementu DOM tooltipa.

CoreShop versions 5.0.1 through 5.1.0-beta.1 have a GitHub Actions workflow vulnerability allowing external attackers to achieve RCE by submitting a malicious Pull Request. The workflow uses `pull_request_target` and dangerously checks out code from the PR head.

Froxlor version 2.3.6 and earlier has a vulnerability in DNS record validation for LOC, TLSA, and other types. The LOC regex allows newlines, TLSA matchingType=0 has no upper bound on hex data length, and validators return raw input without zone-file escaping.

Froxlor version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. An attacker with shell access can replace authorized_keys with a symlink to /root/.ssh/authorized_keys, enabling root SSH access.

Froxlor 2.3.6 does not enforce the approved shell list for FTP accounts. An authenticated customer with shell delegation can set an arbitrary shell like /bin/bash, which in the default nssextrausers integration leads to real host shell access.

Froxlor prior to version 2.3.7 has a vulnerability in the DomainZones.add API endpoint that does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines, allowing injection of arbitrary BIND directives and DNS records into the zone file.

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution.

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. An attacker can send YSoSerial.NET-generated BinaryFormatter payloads to achieve code execution as NT AUTHORITY\SYSTEM. The vulnerability was corrected in BarTender 12.1.

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. An attacker who controls the mirror or performs a man-in-the-middle attack on a non-TLS connection can run arbitrary commands on the victim's system.

An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted command to the at_command.asp interface.

The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS messages before storing and displaying them. An attacker can send an SMS containing a malicious XSS payload, which will be executed in the context of the victim's browser when the message is viewed.

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. Unicode digits or non-digits in the mask portion were ignored, potentially allowing larger networks. Leading zeros were treated as decimal instead of octal, causing confusion.

Vulnerability in the Net::CIDR::Set library for Perl (versions up to 0.20) due to lack of IP address validation. The add method calls _encode, which for malformed addresses leads to infinite recursion, causing a denial of service.

In Etsy::StatsD for Perl versions through 1.002002, metric names and values are not checked for newlines, colons or pipes, allowing metric injections from untrusted sources.

Improper Access Control and Missing Authorization in WriteUp Mobile App (versions 1.3.0 through 04062026) allows accessing functionality not properly constrained by ACLs.

The RabbitMQ driver in oslo.messaging (versions 1.0.0 through 17.3.0) does not verify the TLS hostname when connecting to the broker. Even with ssl_ca_file configured, any certificate signed by the deployment CA is accepted, allowing an attacker to intercept traffic and perform man-in-the-middle attacks on RPC and notification traffic.