CVE Vulnerability Catalog

Nexus Repository 3 had an endpoint for changing the administrator password during initial onboarding. It did not verify that onboarding was still in progress, relying on a local artifact. An account with nexus:* permission could invoke the endpoint outside the intended flow to replace the admin password, and existing sessions were not invalidated.

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, when parsing malformed TTF files. The issue is in the stbtt__GetGlyphShapeTT() function in stb_truetype.h, triggered when an application loads, bakes, or renders a malicious font.

A vulnerability in the Telefunken TE24553B45V2DZ Smart TV (Vestel MB181 / Voltron181 / TiVo OS platform) allows an attacker on the same local network to force the embedded browser to send requests to unintended loopback/internal destinations, including 127.0.0.1. The issue affects firmware version V2.78.0.0 and is fixed in V2.85.2.0.

An SQL injection vulnerability exists in postgrex (part of elixir-ecto) from 0.19.3 before 0.22.4 via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter and extend the streamed statement with their own clauses.

An unauthenticated stored XSS vulnerability in SP Page Builder (< 6.7.0) for Joomla allows an attacker to store malicious JavaScript in the site's database via a single HTTP request. When an administrator opens the editor, the script executes automatically.

Dell OpenManage Server Administrator versions prior to 11.1.0.2 contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it, leading to unauthorized access.

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory from version 0.16.0 before 1.5.0. Users of other language implementations are not affected.

Tobit Laboratories AG TeamDavid's Webbox uses a hard-coded cryptographic key vulnerability. Passwords for locally created users in David are stored in various files using only obfuscation, so any user with access to the server's file system or who can extract files can potentially obtain affected users' passwords.

Tobit Laboratories AG TeamDavid's Webbox application has a buffer overflow vulnerability in password change functionality triggered by including "(editini)" in the file path. The application does not verify that the provided path actually refers to an "Archive.ini" file, allowing an attacker to specify a different file with excessive size. An unauthenticated attacker can crash the server, resulting in denial of service.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm) containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed.

Tobit Laboratories AG TeamDavid's Webbox search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to local file inclusion in the send email, fax, SMS functionality. By specifying an '@@attach' command in the 'scjob' form field, files can be attached and downloaded by an authenticated user. The filter restricting access to the David config folder and user folder can be bypassed using alternate data streams, allowing download of sensitive files like other users' access files with passwords or the server's private key.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to arbitrary file deletion in the send email, fax, SMS functionality. By specifying an '@@COMMENTFILE' command in the 'scjob' form field, any file on the system can be deleted.

DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable.

Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.

Vulnerability allowing access to unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the device's web interface.