CVE Vulnerability Catalog

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control and does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control and does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. A high-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation does not require user interaction and the scope is changed.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to bypass authentication through an alternative path or channel. A successful exploit could lead to code execution, privilege escalation, information disclosure, and data tampering.

A vulnerability in Symfony allows an attacker to inject forged Twilio status payloads by bypassing the X-Twilio-Signature HMAC header verification. The TwilioRequestParser::doParse() method ignores the configured webhook secret, enabling unauthenticated POST requests.

An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The soup_multipart_input_stream_read_headers() function does not properly restrict the size of boundary strings, leading to a read past the allocated buffer. A remote unauthenticated attacker can exploit this to cause a denial of service (DoS) or potentially read unauthorized memory fragments.

A vulnerability in libsoup's HTTP/2 implementation causes improper memory release under specific stream termination conditions, such as window exhaustion or explicit stream resets. A remote unauthenticated attacker acting as a malicious network peer can force the connection engine to allocate stream states that are subsequently leaked during cleanup. Over time, this leads to heap exhaustion and an Out-of-Memory (OOM) crash, resulting in a denial of service (DoS).

The TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks.

A vulnerability in Symfony's MailtrapRequestParser::doParse() ignores the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. Affects versions prior to 7.4.12 and 8.0.12.

Symfony prior to versions 6.4.40, 7.4.12, and 8.0.12 has a vulnerability in the Mailjet and LOX24 bridges where webhooks do not verify configured secrets, allowing unauthenticated POST requests with forged payloads.

A vulnerability in Symfony, versions from 6.1.0-BETA1 to 6.4.40, 7.4.12, and 8.0.12, occurs because UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes (action, formaction, poster, cite). Configurations that allow these attributes may leave javascript: URIs unsanitized, enabling XSS when the resulting HTML is rendered or a victim interacts with a form or button.

A stored XSS vulnerability in Symfony's development profiler file_excerpt Twig filter interpolates lines from non-PHP files directly into <code> elements. Affects versions from 6.4.24 to 6.4.40, 7.4.12, and 8.0.12.

A vulnerability in Symfony allows email header injection due to improper validation of parameter names in the ParameterizedHeader class. An attacker can pass untrusted input containing CRLF characters, enabling the addition of extra headers to messages.

Symfony from 6.1.0-BETA1 to 6.4.40, 7.4.12, and 8.0.12 has a vulnerability in UrlSanitizer::parse() that passes Unicode BiDi formatting characters into sanitized href and src attributes. This allows a link to visually differ from its actual destination, enabling phishing.

A heap buffer over-read vulnerability was discovered in libsoup versions 3.0 to 3.7.0 in the HTTP/2 GOAWAY frame handling. Missing length validation allows a remote unauthenticated attacker to send a malformed frame, causing application crash (DoS) or potential memory content leak.

A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings.

A security vulnerability was discovered in NETGEAR Nighthawk RAX series routers that allows an authenticated user to execute unauthorized commands or code on the device.

A security flaw in the certificate validation process was discovered in the NETGEAR XR1000 Gaming Router and certain Nighthawk models. This allows an unauthorized attacker to remotely access and take control of the device.

A security flaw in certain NETGEAR RAX routers allows a logged-in user to send specially crafted requests and execute unauthorized commands. This could lead to unauthorized changes to the router's configuration.

A security flaw was found in certain NETGEAR Orbi models that could allow an unauthorized user to cause the device to stop responding or restart unexpectedly, disrupting network connectivity and making the device temporarily unavailable.