CVE Vulnerability Catalog

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device's intended operation.

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

A vulnerability in the Teradata provider for Apache Airflow affects the example Dag, which defines parameters as free text and templates them into operators, allowing a user with lower privileges to inject SQL fragments. This can lead to code execution under the task's connection and redirect the task to other connections.

GitLab CE/EE has a vulnerability allowing arbitrary JavaScript execution in another user's browser session due to improper sanitization of path components in the merge request diff viewer. Affects versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. An `account` value containing `/`, `?` or `#` demoted the intended domain to a path, query or fragment, leaving the attacker in control of the request host. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL.

A vulnerability in the Google provider for Apache Airflow involves improper interpolation of file and folder names into Google Drive queries without escaping quote characters. An attacker controlling names (e.g., by creating objects in buckets) can inject additional clauses into the query, potentially redirecting transfers to unauthorized locations or swapping downloaded files.

A vulnerability in the Teradata provider for Apache Airflow causes cloud storage credentials to be embedded directly into SQL statements by the S3ToTeradataOperator and AzureBlobStorageToTeradataOperator. The credentials end up in Airflow task logs and Teradata query logs (DBQL), where they are not masked. The issue affects the default authentication path when no AUTHORIZATION object is configured.

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet, which can be used for configuration file upload, leading to information disclosure and integrity compromise. The servlet is intended for testing in non-production environments.

A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. No further technical details are provided in the description.

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft, or other unauthorized actions.

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. The application searches for resource files in predictable paths under C:\gs\ that do not exist by default, and Windows default ACLs allow any authenticated user to create directories at the root of C:\. An attacker can create the expected directory structure and plant a malicious PostScript file, which is executed with full privileges of the Ghostscript process. Fixed in version 10.08.0.

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability.

GitLab EE contains improper authorization enforcement. An authenticated user with guest-level permissions could read private security policy content they were not authorized to access.

In the dash shell, the printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b can write one or two bytes past that reservation.

In the dash shell, when built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames or otherwise feed that matcher can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.

Path Traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.