CVE Vulnerability Catalog

Directory Traversal vulnerability in mcp-filesystem-server v0.11.1 due to improper link resolution in validatePath. When EvalSymlinks returns os.IsNotExist for a dangling symlink, the fallback validates only the parent directory and returns the unresolved path, allowing file writes outside allowed directories.

Improper Access Control in ArgusMonitor.sys in Argotronic ArgusMonitor 7.4.02 and earlier allows local low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service.

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint.

KitchenAsty through 0.3.0 contains an IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id applies authentication middleware but lacks ownership or role checks, and the getReservation handler returns the record by client-supplied identifier without comparing reservation.customerId to the authenticated principal.

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could interrupt the normal operation of the affected service, which recovers without manual intervention.

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service.

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service.

A sensitive information disclosure vulnerability exists in the underlying OS of HPE Networking Instant On. Successful exploitation by an authenticated local attacker with high privileges could retrieve information useful for further access to network services, but only if certain preconditions outside attacker's control are met.

A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could interrupt normal operation and access limited information within the component.

A denial-of-service vulnerability in the API endpoint of HPE Networking Instant On could allow an authenticated attacker with administrative privileges to cause a denial of service. The service resumes without manual intervention.

A local privilege-escalation vulnerability in the affected daemon of HPE Networking Instant On could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met.

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow limited data access and limited changes.

An authentication bypass vulnerability in the PAPI protocol of HPE Networking Instant On APs could allow an unauthenticated adjacent attacker to circumvent authentication controls. Successful exploitation could allow sending unauthorized network traffic to the target device.

A format string vulnerability in the API endpoint of HPE Networking Instant On APs could allow an authenticated remote attacker with high privileges to cause memory corruption with modified input. Successful exploitation could lead to DoS or remote code execution.

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain unauthorized access to restricted networks.

A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges.

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.