CVE Vulnerability Catalog

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in loss of real-time alarm functionality and disruption of event notifications.

Format string vulnerability in the ONVIF AddScopes function in Tapo C520WS v2. User-controlled input is improperly passed to formatting functions. An attacker can inject format specifiers, causing the ONVIF service to crash and resulting in DoS.

The Tapo C520WS v2 device has a stack-based buffer overflow vulnerability in the ONVIF DeleteUsers service due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted request with an excessive number of identifiers to overflow stack memory.

A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption.

The Charitable – Donation Plugin for WordPress up to version 1.8.11.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in the profile avatar update flow. The save_avatar() function deletes an attachment based on ID from the 'avatar' meta without ownership verification, and process_picture() returns raw values, allowing meta poisoning and arbitrary attachment deletion. Attack requires Subscriber-level access or higher.

The Alba Board plugin for WordPress up to version 2.1.3 has an authorization bypass vulnerability – it does not properly verify user permissions. Authenticated attackers with subscriber-level access can read private alba_card data (title, description, assignee, due date, tags, comments) intended only for Administrators and Editors. Additionally, the handler is registered via wp_ajax_nopriv_ and the nonce is exposed on pages with the [alba_board] shortcode, allowing unauthenticated users to exploit it as well.

Vulnerability in the IDNA library for Python (versions prior to 3.15) to DoS via specially crafted domains. Payloads like `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` use the `valid_contexto` function before length rejection, causing long processing times for high N. This is similar to CVE-2024-3651 but the original fix was incomplete. Version 3.14 introduced early rejection of long inputs, and 3.15 extended this to other functions. A workaround is to enforce a 253-character limit before passing the domain to `idna.encode()`.

HAX CMS versions prior to 26.0.0 have an improper session termination vulnerability where authentication tokens remain valid after user logout. Attackers with valid tokens can maintain persistent access to CMS functionality, bypassing session termination.

HAX CMS before version 26.0.0 contains an Authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint. A low-privileged user can read arbitrary files on the server by manipulating the location field in site.json. This allows exfiltration of sensitive system files.

HAX CMS, used to manage microsites with PHP or Node.js backends, crashes before version 26.0.0 when an authenticated attacker sends a crafted site creation request to the createSite endpoint. A single request can take the entire application offline, requiring a manual server restart.

OpenXDMoD prior to version 11.0.3 has a JavaScript injection vulnerability via authenticated attacker profile. The attacker can inject malicious script and abuse password reset to email a link; when clicked, the script executes in the victim's browser, potentially leading to account takeover.

Open XDMoD before version 11.0.3 has a flaw in access control logic that allows an attacker to send a crafted HTTPS POST request setting a session variable used for authorization. If the optional Job Performance (SUPReMM) module is installed, the attacker can bypass data access restrictions and view other users' compute job efficiency metrics.

An administrative cross-site scripting (XSS) vulnerability exists in the web UI dashboard of Arista Edge Threat Management (Arista NGFW). Unvalidated user input is reflected in administrative profiles, allowing malicious code execution.

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW), allowing authenticated administrators to obtain underlying terminal script code processing execution permissions.

A command injection vulnerability exists in the Captive Portal Custom Handler of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW), allowing an authenticated administrator to execute arbitrary platform shell commands.

A vulnerability was discovered in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) version 17.4.0 in the Reports application due to insecure input validation. Earlier software releases are not affected.

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) version 17.4.0, allowing execution of arbitrary shell commands.

HAX CMS versions from 2.0.0 to 26.0.0 have the gitlist plugin exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history.

Na dotkniętych platformach z obsługą sprzętowego IPSec działających na Arista EOS z włączonymi określonymi funkcjami IPsec, EOS może wykazywać nieoczekiwane zachowanie w określonych przypadkach. Fluktuacje interfejsów fizycznych oraz niektóre restarty agentów mogą powodować ponowne nawiązywanie tunelu IPsec z istniejącymi skojarzeniami bezpieczeństwa, co prowadzi do niezgodności numerów sekwencyjnych między punktami końcowymi tunelu.

W urządzeniach D-Link DWR-M920 do wersji 1.1.50 zidentyfikowano lukę, która pozwala na zdalne wstrzyknięcie poleceń systemowych poprzez manipulację argumentem IMEI_value w funkcji sub_412DA0 w pliku /boafrm/formIMEISetup.