CVE Vulnerability Catalog

An integer overflow or wraparound vulnerability in Samsung Open Source rlottie leads to buffer overflows. This issue could allow an attacker to execute code or cause a crash.

In AREA 17 Twill CMS up to version 3.6.0, a vulnerability was found in the FileLibraryController::storeFile function in FileLibraryController.php. Manipulation of the qqfilename argument allows unrestricted file upload, potentially leading to remote code execution.

A vulnerability was found in MacCMS Pro up to version 2022.1000.3005 in the installation module. The step5 function in file application/install/controller/Index.php allows authorization bypass. The attack can be launched remotely but requires high complexity and is considered difficult to exploit.

A security flaw was discovered in Wavlink WL-NU516U1 version 260515. The function wlink_uci_set_value in the file /cgi-bin/adm.cgi allows remote OS command injection via manipulation of the lan_ip argument. The exploit has been publicly released and may be used in attacks.

A code injection vulnerability was found in pig-mesh Pig up to version 3.9.2 in the pig-codegen component. The issue affects an unknown functionality of the GeneratorServiceImpl.java file. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was found in Leantime up to version 3.8.0 in the Setting::saveSetting function of the API component. Manipulation leads to improper authorization, allowing remote attacks. The exploit has been made public and could be used.

A vulnerability in Leantime up to version 3.8.0 affects the JSON-RPC Endpoint component. The editUser/addUser functions improperly authorize the 'role' argument, allowing unauthorized privilege changes. The attack is remotely exploitable and exploit details are publicly available.

A server-side request forgery (SSRF) vulnerability has been found in Helicone ai-gateway up to version 0.2.0-beta.30. The flaw exists in the build_target_url function in ai-gateway/src/dispatcher/service.rs, where manipulation of the extracted_path_and_query argument allows an attacker to send requests to internal resources, including the AWS Metadata Service. The attack can be performed remotely and an exploit has been published.

A missing authorization vulnerability was found in Coolify up to version 4.1.1 within the Policy Handler component. An unknown function in the /app/Policies/ file can be exploited remotely without proper authentication. The exploit is publicly available.

A buffer overflow vulnerability was found in the nRF70 Wi-Fi driver's power-save event handler. The function copies TWT entries from an event into a fixed-size array without validating the entry count, leading to an out-of-bounds write.

In Zephyr's USB host stack (CONFIG_USB_HOST_STACK), a use-after-free and double-free vulnerability exists. The usbh_device_disconnect() function frees the root object without clearing ctx->root, and UHC drivers generate removal events without guards, allowing an attacker with physical USB access to trigger double memory free.

A SQL injection vulnerability was found in the PayPal IPN Payment Handler component of Antaris 1.0. The _rewardPurchase function in /ipn.php improperly handles the item_number argument, allowing remote attacks. The vendor did not respond to the disclosure.

A server-side request forgery (SSRF) vulnerability has been detected in AstrBot up to version 4.25.2 in the MCP Test Endpoint component. The issue affects the ToolsRoute.test_mcp_connection function in the file astrbot/dashboard/routes/tools.py, where an attacker can manipulate the mcp_server_config.url argument. The vulnerability has been publicly disclosed and can be exploited remotely.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read internal org_id and provider_id values via the /private/sso/check-domain endpoint. This enables mapping email domains to organization UUIDs and SSO provider identifiers, facilitating reconnaissance against Capgo tenants.

A vulnerability in Capgo before version 12.128.2 in the POST /webhooks/test endpoint allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks, bypassing the limited_to_apps authorization check.

A server-side request forgery (SSRF) vulnerability has been identified in AstrBot up to version 4.25.2. The issue exists in the get_online_plugins function within astrbot/dashboard/routes/plugin.py, where manipulation of the custom_registry argument in the market_list endpoint allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.

A security flaw in the Scheduled Task Handler component of AstrBot up to version 4.25.2 affects the FutureTaskTool.call function in astrbot/core/tools/cron_tools.py. Manipulating the payload["note"] argument causes improper authorization, allowing remote exploitation. The exploit has been publicly released and may be used in attacks.

In SonicCloudOrg sonic-agent up to version 2.7.2, a vulnerability was found in the evalIsFailed function in GroovyScriptImpl.java allowing OS command injection. The attack can be launched remotely and the exploit has been made public. The product is no longer supported by the vendor.

In the Android WebSocket Server component of sonic-agent up to version 2.7.2, a vulnerability allows OS command injection. The flaw resides in an unknown function of AndroidWSServer.java, where manipulation of the path argument enables remote command execution. The vendor did not respond, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 in the file manager/network/switch_status.php. Manipulating the ID argument allows remote exploitation. The exploit has been published and may be used.