CVE Vulnerability Catalog

The DefaultBaseTypeLimitingValidator in jackson-databind, applied automatically when @JsonTypeInfo is used without a custom validator, omitted java.lang.Comparable from its list of unsafe base types. As a result, an application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type accepts type identifiers for essentially any class implementing Comparable, giving an attacker-controlled object instantiation primitive. A demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path.

Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to gain unauthorized access to sensitive sensitive system information.

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance.

The httpc module in Erlang/OTP inets has an improper validation of specified quantity vulnerability. A malicious or compromised HTTP server can degrade availability by returning a numeric header with a very long run of digits, causing expensive integer conversion.

The eldap module in Erlang/OTP has an improper validation of specified quantity vulnerability. A malicious or compromised LDAP server can degrade availability by returning a referral URL with a very long port, causing expensive integer conversion.

The snmp module in Erlang/OTP has an improper validation of specified quantity vulnerability. A remote attacker can degrade availability by sending an SNMP message containing a BER INTEGER with an arbitrarily large length field, causing expensive bignum arithmetic.

The stdlib module in Erlang/OTP has an improper validation of specified quantity vulnerability. A remote attacker can degrade availability by supplying a URI with a very long port, causing expensive integer conversion.

Xinhu Rainrock RockOA up to version 2.7.6 has an SQL injection vulnerability in the getOrder function of webmain/webmainAction.php. Manipulating the highorder argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the updateLanIp function. Unauthenticated attackers can refresh the LAN address state by sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the cs_broker component.

TOTOLINK T6 version 4.1.5cu.748_B20211015 has an incorrect access control vulnerability in the staticInfoSend function. Unauthenticated attackers can trigger static information reporting to the configured master by sending a crafted MQTT message to the cs_broker component.

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 allows unauthenticated attackers to update stored slave inventory records via a crafted MQTT message to the cs_broker component.

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled.

CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.

A denial-of-service vulnerability in FactoryTalk® Historian Machine Edition. An authenticated network-adjacent attacker can send crafted requests to the web interface, causing buffer overflow conditions that may crash the device and make it unresponsive.

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.