CVE Vulnerability Catalog

In EAP IIOP, the NameService accepts bind operations without authentication, allowing an attacker to hijack JNDI lookups and bind them to a malicious ORB, achieving MITM or DoS on further invocations.

In EAP jboss-remoting, a remote unauthenticated attacker who can reach ports 8080, 9990, or 4447 and complete an 'Upgrade: jboss-remoting' handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

In EAP undertow HTTP/1.1 chunked-transfer decoder, missing limits on size and count allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener and achieving denial of service.

When EAP runs with -secmgr, the openjdk-orb's JDKBridge honors attacker-supplied CDR codebase URLs during object unmarshalling on port 3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

In Picketlink's SP signature validation, a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and authenticate as any principal with any roles on the protected application.

In JBoss marshalling, the Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering, enabling RCE via deserialization gadget chains on every cluster node.

The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected by an Authenticated Path Traversal vulnerability in the Exchange Online backup module.

A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.

ASUS GPU Tweak III, GPU Tweak II, AI Suite 3, and VGAdll have an untrusted pointer dereference vulnerability. An IOCTL vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation.

Chiline Cloud developed by Inventec Appliances has an Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected information, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker's control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.

A vulnerability in tls_opt_dtls_peer_connection_id_value_get() in Zephyr (subsys/net/lib/sockets/sockets_tls.c) causes an out-of-bounds write in the kernel. The function passes the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer is at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. In CONFIG_USERSPACE builds, an unprivileged thread can trigger a kernel buffer overflow by passing a small optlen on a connected DTLS socket with Connection ID enabled.

In certain TP-Link Aginet devices, web interface components do not properly validate and sanitize user-supplied input before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operating system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise.