CVE Vulnerability Catalog

Tautulli versions prior to 2.17.1 do not enforce POST method on the `configUpdate` endpoint and lack anti-CSRF tokens. An attacker can trick a logged-in administrator into visiting a malicious page that submits a cross-site request, overwriting the admin username and password, leading to administrative interface takeover.

Tautulli is a monitoring tool for Plex Media Server. Prior to 2.17.1, the `log_js_errors` endpoint is accessible to any authenticated user, including guests. It writes attacker-controlled strings to the application log. The admin-only `logFile` view reads the log and embeds it into HTML without escaping, causing stored XSS. A guest can inject HTML/JavaScript that executes in an administrator's browser.

The bacnet_stack library version 1.3.1 contains an out-of-bounds read in the bacnet_tag_number_decode function, allowing attackers to cause a denial of service.

Tautulli prior to 2.17.1 is vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before setup wizard completion, all management endpoints are unauthenticated. An attacker can create a newsletter agent, point the template directory to a malicious SMB share with a Mako template, and trigger execution via the newsletter render endpoint.

GNCC GP5 v7.1.76 stores pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. Physically-proximate attackers can extract these active tokens to perform unauthorized operations via monitoring the serial UART interface.

In the over-correlations endpoint of MISP, the order parameter was accepted from user-controlled request parameters, allowing an authenticated attacker to override server-side ordering. This could lead to database query manipulation.

GX Earth 2022 ONT models have a hardcoded RSA private key in the firmware. A remote attacker can extract it, enabling decryption of HTTPS traffic and Man-in-the-Middle (MITM) attacks.

HCL Hive Telco Observability has a vulnerability in the Keycloak component due to missing required Content Security Policy (CSP) directives. This can leave the site vulnerable to attacks.

Vulnerability in Dell BSAFE SSL-J due to allocation of resources without limits or throttling. An unauthenticated remote attacker could potentially exploit this, leading to a Denial of Service (DoS).

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability allowing unauthenticated attackers to manipulate database queries via the 'tid' parameter. Attackers can send GET requests with malicious 'tid' values to extract sensitive database information.

The Ping Client in LabF nfsAxe 3.7 has a buffer overflow vulnerability allowing local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.exe or other arbitrary commands.

AllPlayer 7.4 has a local buffer overflow vulnerability in URL handling, allowing attackers to overwrite structured exception handling pointers by supplying an excessively long URL string. Attackers can craft a malicious URL, paste it into the Open URL dialog, and trigger SEH-based code execution to run arbitrary commands with user privileges.

NetShareWatcher 1.5.8.0 has a structured exception handler buffer overflow vulnerability allowing local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to trigger code execution when the Find function is invoked.

PHP EI-Tube Script 3 contains an SQL injection vulnerability allowing unauthenticated attackers to execute arbitrary SQL queries via the search parameter. Attackers can send GET requests with crafted SQL payloads to extract sensitive database information including usernames, passwords, and version details.

Listing Hub CMS 1.0 has a SQL injection vulnerability in the id parameter. An unauthenticated attacker can send a GET request to pages.php with a crafted id value using error-based SQL injection to extract database credentials, usernames, and version information.

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

All in One Video Downloader 1.2 contains an SQL injection vulnerability in the id parameter, allowing unauthenticated attackers to execute arbitrary SQL queries. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive data such as usernames, databases, and version details.

This vulnerability in GX Earth ONT models transmits user credentials in plaintext over HTTP in the web management interface. A remote attacker can intercept network traffic to obtain sensitive authentication information, leading to unauthorized access to the device.

This vulnerability in GX Earth ONT models is due to improper handling of user-supplied input in diagnostic functions of the web management interface. An authenticated remote attacker can inject and execute arbitrary OS commands on the device.