CVE Vulnerability Catalog

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability.

GitLab EE contains improper authorization enforcement. An authenticated user with guest-level permissions could read private security policy content they were not authorized to access.

In the dash shell, the printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b can write one or two bytes past that reservation.

In the dash shell, when built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames or otherwise feed that matcher can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.

Path Traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.

Apache Karaf has a vulnerability in JMX MBeanServer security, where createMBean, registerMBean, and unregisterMBean operations are not subject to RBAC. This allows a user with the 'viewer' role to achieve remote code execution in the Karaf JVM by using MLet as a remote classloader.

Apache Karaf's config:install command is not covered by any ACL rule and is therefore allowed for any authenticated user, including one with only the viewer role. The command fetches a file from an arbitrary URL and writes it into karaf.etc, which contains security-relevant files such as users.properties, keys.properties, host.key, and all ACL configuration files. With the --override flag, existing files can be overwritten, and Felix FileInstall automatically reloads changed .cfg files without requiring a restart.

A vulnerability in Apache Karaf is due to the lack of an ACL configuration file for jdbc and jms commands, allowing any authenticated shell session (even with the viewer role) to execute all jdbc:* and jms:* commands. The jdbc:ds-create command allows storing an arbitrary JDBC URL, which can lead to code execution at the connection level, bypassing the admin role gate.

A vulnerability in Apache Karaf allows a user with the "manager" role to write arbitrary content to any file the Karaf process can write to. This is achieved by bypassing path checks in ConfigRepositoryImpl.update() and createFactoryConfiguration(), where the felix.fileinstall.filename value or a PID with ".." segments can point outside the ${karaf.etc} directory.

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content. Insecure deserialization of this content allows arbitrary code execution in the Octopus Server process.

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

Progress Telerik Fiddler Everywhere before version 8.2.0 exposes privileged IPC functionality. A local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application can replace the application UI or settings with attacker-controlled content.

A vulnerability was identified in tacomall 1.0.0 in the OrgStaffServiceImpl.add function of ApiMaApplication.java in the api-admin Backend component. Manipulation of the isAdmin/jobId arguments leads to improper authorization. Remote exploitation is possible and the exploit is publicly available.

A vulnerability has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected is some unknown functionality of the file users.php, where manipulation of the Search argument causes cross site scripting, and the attack can be initiated remotely.