CVE Vulnerability Catalog

The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser. A crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who grants consent.

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. Someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. Someone with access to the Zabbix trapper port can report an arbitrary host using an active agent as available, resulting in a loss of integrity.

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it.

The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input, leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database.

The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator.

The WP Dummy Content Generator plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WP Dummy Content Generator from n/a through 4.0.0.

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0 affecting the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the Department Search Endpoint component. Manipulation of the keyword argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used; the project was informed but has not responded yet.

A vulnerability has been detected in feelcrm-os 1.0.0 (feelec-yishu project). It affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php in the getCurlData Endpoint component. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected is the htmlspecialchars_decode function of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the Create Customer Endpoint component. Manipulation of the customer_form[remark] argument results in cross site scripting, and the attack can be initiated remotely. The exploit has been made public and could be used; the project has not responded to the issue report.

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values; the check fails and reports an error, and the default error handler halts the device.

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0 affecting the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the Crm Endpoint component. Manipulation of the redirect_url argument leads to cross site scripting, and the attack may be performed remotely. The exploit has been disclosed publicly and may be used; the project was informed but has not responded yet.

A flaw has been found in feelec-yishu feelcrm-os 1.0.0 affecting an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the getMemberByGroups Endpoint component. Manipulation of the groups[] argument causes sql injection, and the attack is possible remotely. The exploit has been published and may be used; the project was informed but has not responded yet.

A vulnerability was detected in Totolink A3002MU version 1.0.0-B20230403.1455. It affects the function sub_44B250 in the file /boafrm/formUploadFile of the File Upload Handler component. Manipulation of the filename argument results in path traversal. The attack can be executed remotely, and the exploit is public.

A vulnerability has been detected in Totolink A3002MU version 1.0.0-B20230403.1455. It affects an unknown function in the file /boafrm/formIpQoS of the QoS Rule Handler component. Manipulation of the addQos/comment/entry_name arguments leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit has been publicly disclosed.

An Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks. This issue affects CURCY from n/a through 2.2.17.

A Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Starter Templates from n/a through 4.7.7.

A vulnerability was found in the system-call verifier for i3c_do_ccc() in Zephyr RTOS, which fails to validate per-target data pointers in the i3c_ccc_payload structure. The verifier also operates on the caller's live structure, allowing another thread to modify fields between check and use. This allows an unprivileged thread to write to arbitrary kernel addresses (via read CCC) or disclose kernel memory (via write CCC), leading to privilege escalation.

The NXP GAU ADC driver (adc_mcux_gau_adc.c) incorrectly validates the caller-supplied buffer size: it compares bytes against the number of channels (samples) and then uses that byte count as the number of uint16_t slots. As a result, a buffer accepted as 'large enough' can be written up to twice its size in bytes, causing an out-of-bounds write for every sample past the buffer's midpoint.

A weakness has been identified in Totolink A3002MU version 1.0.0-B20230403.1455. It affects the function sub_40FCFC in the file /bin/boa of the Authentication Check component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely, and the exploit has been made publicly available.