CVE Vulnerability Catalog

A vulnerability was found in the WAVLINK WN553X1-B device (version V260403_2.0.0) in the sub_41A748 function of /bin/ioos, part of the WireGuard CLI Group Handler. Manipulating the group_id/group_name arguments can lead to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was found in WAVLINK WN553X1-B (V260403_2.0.0) in the sub_419DA8 function of /bin/ioos, within the WireGuard CLI Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been made public.

A vulnerability has been found in WAVLINK WN553X1-B (260403_2.0.0) in the sub_4162A8 function of /bin/ioos, within the ovpn_file Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be executed remotely and the exploit has been disclosed to the public.

A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58 in the isInterruptExpired function of sdks/typescript/packages/client/src/interrupts/index.ts, within the Interrupt expiry component. The manipulation causes resource consumption. Remote exploitation is possible and the exploit has been published.

Google::Auth versions 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. A local attacker can submit an authorization code for their own Google account, and the CLI exchanges it and stores the refresh token as the user's credentials.

Google::Auth version 0.12 for Perl allows server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. The Aws class sends GET and PUT requests to the imdsv2_session_token_url, url and region_url fields without the host check applied by other credential classes.

A vulnerability was detected in ag-ui-protocol ag-ui up to version 0.0.58 in an unknown functionality of the Transport Decoder Handler component. The manipulation results in improper input validation. The attack may be launched remotely and the exploit is now public.

The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.

The BookIt plugin (Liquid Web / StellarWP) contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions up to and including 2.6.0.6.

The Generative UI sandbox in prefab-ui runs caller-supplied Python inside Pyodide (WebAssembly) in a Deno subprocess, but from 0.14.0 through 0.20.2 Deno starts with unrestricted --allow-read, --allow-write, and --allow-net, and the Deno API remains on the JavaScript global object. This lets Python call Deno.readTextFileSync and Deno.writeTextFileSync, enabling file read/write as the server OS user and persistent code execution via a .pth file in site-packages.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the parseSSEStream function in sdks/typescript/packages/client/src/transform/sse.ts (SSE Parser component) allows excessive resource consumption. The attack can be launched remotely and the exploit has been publicly disclosed.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the e.text function in the HTTP Transport component allows excessive resource consumption. The attack can be launched remotely and the exploit has been made publicly available.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the file sdks/typescript/packages/client/src/agent/http.ts (HttpAgent component) contains a flaw leading to information disclosure. The attack can be launched remotely and the exploit has been publicly released.

The JetFormBuilder plugin (Crocoblock) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. The issue affects versions up to and including 3.6.7.1.

A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2 in the function sub_23908 of the shield.sys library, part of the Kernel Driver component. The manipulation leads to memory corruption. The attack can only be performed locally and the exploit is publicly available.

A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0 in the function sub_416568 of /bin/ioos, part of the OpenVPN CLI Handler. Manipulating the file_id argument leads to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was found in WAVLINK WN701AE 260105 in the function del_vlan_group of the ioos Web Backend. Manipulating the vlan_name argument results in OS command injection. The attack may be performed remotely and the exploit has been made public.

A vulnerability was found in WAVLINK WN553X1-B version 260403_2.0.0 affecting the sub_416B50 function in /bin/ioos. Manipulation of the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

A flaw was found in WAVLINK WN553X1-B version V260403_2.0.0 affecting the sub_416D88 function in /bin/ioos (ioos Service component). Manipulation of the group_id/group_name arguments can lead to OS command injection. The attack can be executed remotely and the exploit has been published.

In the lud jsv library (versions from 0.1.0 before 0.26.2) an improper check for unusual or exceptional conditions exists in the pattern and patternProperties keywords. JSV.Helpers.RegexExt.bounded_match?/2 calls :re.run/3 without :report_errors, so exhausting the backtracking budget returns :nomatch just like a real non-match, allowing schema validation bypass. Only schemas whose regex explores a catastrophic branch before the matching branch are affected.