CVE Vulnerability Catalog

The Yontem Informatics Vehicle Tracking System has an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects versions before 8.

SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access the system with regular user privilege to read application data and execute submission and approval processes.

SmartSoft SmartBPM.NET has a vulnerability related to the use of a hard-coded machine key. An unauthenticated remote attacker can exploit this key to send serialized payloads to the server to execute arbitrary code and disrupt service.

The CC: Tweaked mod for Minecraft prior to versions 1.20.1-1.106.0, 1.19.4-1.106.0, 1.19.2-1.101.3, 1.18.2-1.101.3, and 1.16.5-1.101.3 does not blacklist metadata API endpoints by default on popular cloud hosting providers like AWS, GCP, and Azure. This allows players to access sensitive information, potentially leading to privilege escalation within the cloud provider.

The OpenComputers mod for Minecraft has a vulnerability that allows players to access sensitive information from cloud metadata services when the Internet Card feature is enabled. This affects versions from 1.2.0 to 1.8.3 in default configurations.

The TOTOLINK A3300R device in version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.

A command injection vulnerability was discovered in the TOTOLINK A3300R device version V17.0.0cu.557_B20221024 via the ip parameter in the setDiagnosisCfg function.

The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.

The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 has been found to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.

In TravianZ versions 8.3.4 and 8.3.3, incorrect access control in the installation script allows an attacker to overwrite the server configuration and inject PHP code.

In TravianZ versions 8.3.4 and 8.3.3, there is a vulnerability related to the use of a cryptographically insecure random number generator in the password reset function. This allows an attacker to guess the password reset parameters and take over user accounts.

The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.

The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the ussd parameter in the setUssd function.

The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.

The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.

A command injection vulnerability was discovered in Tenda AC10 v15.03.06.26 via the mac parameter in the function formWriteFacMac.

PiiGAB M-Bus contains hard-coded credentials which it uses for authentication.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to create and overwrite arbitrary files in the system through carefully crafted media files. This affects versions from 3.5.0 to 3.5.8 and 4.0.0 to 4.1.2.

Mastodon, an ActivityPub-based social network server, has a vulnerability that allows attackers to bypass HTML sanitization using crafted oEmbed data. This enables the injection of arbitrary HTML into oEmbed preview cards, creating a vector for XSS attacks.