CVE Vulnerability Catalog

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low privileged attacker with remote access could exploit this, leading to information exposure.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could exploit this, leading to filesystem access.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

jxl-oxide, a pure Rust implementation of a JPEG XL decoder, prior to jxl-grid 0.6.2, contains a vulnerability in length calculations on 32-bit platforms when decoding a crafted JPEG XL image. This can lead to out-of-bounds writes, memory corruption, denial of service, or arbitrary code execution.

Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

The SimpleSAMLphp SAML2 library in versions 4.19.2 and 4.20.2 allows attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service. This issue is fixed in versions 4.19.3 and 4.20.3.

The SimpleSAMLphp SAML2 library prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1 has a vulnerability in the HTTPArtifact::receive() flow that can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. In a multi-IdP federation, a malicious or lower-trust IdP can impersonate a higher-trust victim IdP and authenticate as arbitrary users. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

electerm prior to version 3.11.11 constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, leading to arbitrary command execution with the desktop user's privileges. This issue is fixed in version 3.11.11.

electerm prior to version 3.11.11 uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. A malicious SSH server can provide a filename containing traversal components such as ../, allowing writes outside the selected download directory and overwriting files accessible to the desktop user. This issue is fixed in version 3.11.11.

SSHFS from version 1.4 until 3.7.6 accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, an injected ProxyCommand can execute locally before any connection or authentication succeeds. This issue is fixed in version 3.7.6.

Gotenberg from version 8.10.0 until 8.33.0 has a race condition in the newContext function in pkg/modules/api/context.go, where multiple goroutines concurrently write to shared maps and slices. A crafted multipart request with many downloadFrom entries can trigger a fatal 'concurrent map writes' runtime error and terminate the process. The default configuration allows unauthenticated remote attacks, leading to denial of service. This issue is fixed in version 8.33.0.

Gotenberg in version 8.32.0 and earlier has a vulnerability in the IsPublicIP function that does not reject IPv6 prefixes such as 2002::/16, 64:ff9b::/96, fec0::/10, and others that can embed or route to non-public IPv4 destinations. A crafted DNS AAAA record can cause the outbound HTTP client to treat an address wrapping an internal destination (e.g., 169.254.169.254) as public, allowing access to cloud metadata services. This issue is fixed in version 8.33.0.

MyBooks (Talebook) in version 3.41.2 and earlier has a vulnerability in the AdminSettings.post handler for POST /api/admin/settings, which does not check the self.admin_user property despite having the auth decorator. Any authenticated regular user can overwrite server configuration values including SMTP credentials, OAuth client secrets, storage paths, and security feature flags. Additionally, the process_auth_header function fails to verify the account's active flag, allowing unactivated accounts to authenticate. This issue is fixed in version 3.42.0.

Gotenberg in version 8.32.0 and earlier has a vulnerability in filename handling where filepath.Base on Linux does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. A remote attacker can submit such a name, and when the resulting archive is extracted on a Windows system, files can be written outside the intended directory. This issue is fixed in version 8.33.0.