Baza CVE

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via…

Przepełnienie pamięci w Checkmate umożliwia atakującemu destabilizację serwera przez przesyłanie dużych plików.

Przepełnienie bufora w TL-MR6400 v7 umożliwia zdalne wykonanie kodu przez uwierzytelnionego atakującego.

Dereferencja wskaźnika NULL w TL-MR6400 v7 może prowadzić do awarii usługi HTTP.

Przepełnienie bufora w routerach TP-Link TL-MR6400 v7 prowadzi do awarii usługi i utraty dostępu.

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that…

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concurrently, for…

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this…

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Błąd odczytu i zapisu poza granicami w mod_auth_openidc może prowadzić do nieautoryzowanego dostępu.

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server…

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is…

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py…

Brak kontroli autoryzacji w Incus pozwala na kopiowanie instancji, co umożliwia dostęp do tajemnic.

Brak kontroli autoryzacji w Incus umożliwia kopiowanie tajnych wolumenów przez nieuprawnionych użytkowników.

Niewystarczające kontrole dostępu w OMEN Gaming Hub umożliwiają lokalnemu atakującemu eskalację uprawnień.

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS)…

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, which is resolved…

Brak weryfikacji adresów w proxy Headroom umożliwia dostęp do wewnętrznych usług bez uwierzytelnienia.

Brak limitu sesji w serwerze HTTP Spring AI pozwala na atak DoS przez wyczerpanie pamięci.

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs…

Brak weryfikacji dostępu w procedurze report.get pozwala każdemu użytkownikowi na odczytanie pełnej konfiguracji raportu.