CVE Vulnerability Catalog

In the OPSWAT AppRemover driver (ardrv.sys) version 2017.10.02.1551 and earlier, the IOCTL handler 0x2420031 lacks privilege validation. Any local user can open the device and send process termination requests.

In WWBN AVideo prior to version 29.0, a vulnerability in the Authorize.Net webhook handler allows an attacker to bypass signature verification and forge webhook requests with arbitrary payment amounts and target user IDs. The attacker can credit arbitrary wallet balances to any user without a corresponding payment and activate premium subscriptions, leading to free access to paid content and direct revenue loss.

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.

A vulnerability in the KerOS software of the Kerlink Wirnet iStation 868 allows a remote attacker to obtain sensitive information via the community string component. The issue affects version 4.3.3_20200803132042.

A vulnerability in the KerOS software of the Kerlink Wirnet iStation 868 allows a remote attacker to obtain sensitive information via boardID and revisionID components.

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

CoreDNS prior to 1.14.5 has a vulnerability in the rewrite plugin where a missing nil check after calling res.IsEdns0() can cause a panic and crash the process. A remote, unauthenticated client can send a single DNS query to trigger this, degrading availability.

In BunkerWeb versions 1.6.2 through 1.6.12, the BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, allowing low-privilege read-only accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.

A vulnerability in BunkerWeb and BunkerWeb PRO prior to versions 1.6.12 and 0.57 allows a low-privileged authenticated user to escalate privileges through improper validation of the Host header in the UI and API. The issue affects a configuration-dependent input processing path.

A TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) affects handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. The drv_ioc_prop_common() function copies data from user space twice, and a malicious thread can change the size between copies, causing a kernel heap buffer overflow. An unprivileged local user can trigger a system panic or potentially further compromise.

In Activepieces prior to version 0.83.0, the /v1/step-files/signed endpoint did not verify the JWT audience and lacked a null check for decoded fileId. This allowed an authenticated user to retrieve step-files belonging to other tenants on the same instance.

In Activepieces before version 0.82.0, the git-sync feature allowed writes to escape the intended workspace and land on arbitrary paths on the host filesystem. This was due to Git symbolic-link handling not being disabled and insufficient validation of user-supplied identifiers (repository slug, externalId of tables, flows, connections) against directory-traversal sequences.

In cyrus-imapd up to version 3.12.2, the LISTRIGHTS command was not restricted to users with admin access. An authenticated user could call LISTRIGHTS against any mailbox they could name and learn what principals had what access to it.

An issue in cyrus-imapd up to version 3.12.2 allows URLAUTH token forgery. An attacker who knows a victim's folder name for which no auth URL was ever issued can compute a valid HMAC-SHA1 token with a predictable key, gaining read access to the mailbox.

In cyrus-imapd up to version 3.12.2, a vulnerability was found where the LOCALDELETE command bypassed ACL checks. An authenticated non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.

An issue was discovered in cyrus-imapd up to version 3.12.2 in the ESEARCH command. An authenticated IMAP user can enumerate folder names in any account they can name, leading to information disclosure about the mailbox structure.

In cyrus-imapd up to version 3.12.2, the vacation 'fcc' feature bypasses the destination mailbox ACL check. A user with a vacation Sieve script using :fcc can deliver auto-reply copies to any mailbox, regardless of insert permissions.

A vulnerability in Frogman before version 1.6.2 causes plaintext password and secret leakage. The fm_reset_password and fm_add_extension functions return credentials that are then stored in the audit log (oc_audit_log.detail) as JSON. Any user with PERM_READ permission and access to fm_audit_search can recover the stored credentials.

BigBlueButton prior to version 3.0.23 improperly restricted access to local network addresses during presentation URL validation. The redirect following logic has been fixed to block local IP ranges.