CVE Vulnerability Catalog

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.

A vulnerability was found in PickMall Lilishop up to 4.2.4 in /buyer/trade/receipt within the Buyer Invoice List component. Manipulation of the memberId argument leads to authorization bypass. The attack can be launched remotely and the exploit has been disclosed to the public.

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the Mobile Binding component. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in yogeshojha reNgine up to 2.2.0 in the subdomain_discovery function of web/reNgine/tasks.py within the listTargets Endpoint component. Manipulation of the Name argument results in OS command injection. The attack can be launched remotely and the exploit has been made public.

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the System API component. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded.

A vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The issue affects the firmware_check function in /cgi-bin/cstecgi.cgi of the UploadFirmwareFile Handler component. Manipulation of the file_name argument leads to OS command injection. The attack can be performed remotely.

In Punk versions from 0.48 before 0.55 for Perl, Extended CONNECT requests are routed to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

A flaw was found in SSSD due to a missing state validation check in passkey Kerberos handling. A local attacker can send a specially crafted PAM request when passkey authentication is enabled, causing the PAM responder to dereference an uninitialized pointer and crash.

A flaw was found in SSSD where a local attacker with access to the NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This causes an out-of-bounds memory read during packet parsing, crashing the responder process.

A flaw was found in SSSD due to missing input validation in the PAM responder. A local attacker can send a crafted PAM request containing a zero-length authentication token, causing the service to read beyond buffer boundaries and crash the PAM responder.

A flaw was found in SSSD's NSS responder negative cache. An unprivileged local user can repeatedly request lookups for nonexistent entries, causing the cache to grow without bound because it does not limit the total number of stored entries.

A flaw was found in SSSD when configured with the Entra ID identity provider, where lookup names containing single quotes are not properly escaped before being included in Microsoft Graph OData queries. A low-privileged local user can alter query filters to broaden user or group searches.

A flaw was found in SSSD's GSSAPI authentication handling in the PAM responder, where cached connection state is freed without clearing the reference pointer. A local user can send an additional request over the same connection, causing the service to access invalid memory and terminate unexpectedly.

A flaw was found in SSSD where, in LDAP environments configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method can bypass access control restrictions.

A SQL injection vulnerability was identified in girishsaraf Online-Appointment-Booking-System in the book.php file of the Booking Handler component. Manipulation of the Doctor/appointment argument allows remote attacks, and the exploit has been made publicly available.

A flaw was found in SSSD where the service fails to verify the presence of the SID extension before processing it in deployments configured with SID-based certificate mapping rules. A remote attacker can submit a certificate lacking the expected SID extension, causing the process to crash during authentication or lookup operations.

A flaw was found in SSSD where a local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process.

The NFS idmap plugin in SSSD fails to abort after detecting that a cached entry exceeds the destination buffer size, leading to an out-of-bounds write. A local attacker can trigger this by requesting identity lookups that resolve to oversized cached entries, causing a crash of the identity mapping service (DoS) and potential corruption of adjacent process memory.

In the Kerberos Credential Manager (KCM) responder in SSSD, the service fails to release cached objects from memory when credentials are removed. A local user can maintain a persistent connection and repeatedly store and destroy credentials, causing continuous memory growth and ultimately exhausting available memory, rendering the service unresponsive (DoS).

A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder in SSSD during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).