CVE Vulnerability Catalog

The vulnerability involves transmitting a sensitive key in the URL over an unencrypted HTTP connection. The key is sent in plaintext, allowing an attacker monitoring network traffic to intercept it.

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

In 389-ds-base, the server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS. An on-path attacker can inject a crafted LDAP message that is processed after the TLS upgrade, and the response is delivered to the client instead of the client's own pending operation's response.

ClipBucket v5 through 5.5.3-#197 contains an SQL injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can use time-based blind payloads to extract user credentials and emails or modify and delete arbitrary records.

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. They can poison segment descriptors or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. They can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.

The Mooncake transfer engine through version 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

Office-PowerPoint-MCP-Server through version 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files.

A flaw was found in 389-ds-base where an unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

A Cross-Site Scripting (XSS) vulnerability in CAPEC-63 before version 3.0b63 is due to improper neutralization of input during web page generation (CWE-79). This allows an attacker to inject malicious scripts into pages that execute in the victim's browser.

An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.

An OS Command Injection vulnerability exists in Johnson Controls EasyIO FS32. This issue affects EasyIO FS32 versions before 3.0b63.

A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.

An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.

A Cleartext Transmission of Sensitive Information vulnerability exists in Johnson Controls EasyIO NEO. This issue affects EasyIO NEO versions before 3.3b25 and enables Man-In-The-Middle attacks.

An Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo before version 3.3b63 allows collecting data from common resource locations. An attacker can exploit this to access confidential data stored in the system.

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.