CVE Vulnerability Catalog

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This is due to improper input validation for specific HTTP requests; an attacker could send a crafted HTTP request to access parts of the network beyond their intended scope.

A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client is due to insufficient validation of user-supplied input. An authenticated local attacker can send a series of crafted IPC messages to a local socket, allowing limited file write operations with SYSTEM or root privileges. On macOS and Linux, the flaw can be used to obtain full root privileges.

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine related to handling GTP extension headers in the codec. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram, causing an infinite loop and a denial of service condition.

A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.

Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device.

Multiple Cisco products are affected by a vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted GRE payload, causing an unexpected restart of the engine and leading to a bypass or denial of service condition.

A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.

A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 NetFlow Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing UDP Netflow Protocol packets. Sending a single crafted Netflow packet through an established connection can cause an unexpected restart and DoS condition.

A vulnerability in the Snort 3 SMTP MIME Decoder of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. The flaw is due to a lack of error checking when parsing MIME fields of the SMTP header. Sending crafted SMTP packets through an established connection can cause an unexpected restart and denial of service (DoS) condition.

In oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the delete_folder function in ajax.php (AJAX Handler component) lacks authentication when the ID argument is manipulated. The vulnerability can be exploited remotely and a public exploit is already available.

In Electron prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them. This caused the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content.

Electron is a framework for writing cross-platform desktop applications. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page.

Slack Morphism client library versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, the library computes the correct signature for the attacker-controlled timestamp and body and stores it in SlackEventWrongSignatureError.generated_hash, which the default Axum error handler logs. An attacker who can reach the callback endpoint and read logs can use the verifier as an HMAC oracle and resend the request with a valid signature within the five-minute window.

In the Electron framework, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application embedding untrusted iframe content and granting pointer lock based on the requesting origin could grant the permission under the top-level page's identity. This is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.

In Electron prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, pages opened into a new window from links were treated as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page.

In hMailServer 6.0.0 through 6.3.6, the anti-virus attachment-stripping action does not fail securely, allowing a remote unauthenticated attacker to have a message the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning enabled and its action set to remove attachments and deliver the text, the server keeps one text part and replaces every attachment with a note. A message whose single part is not text has no part the action could pick out and is delivered as it arrived.

A vulnerability in hMailServer versions 6.0.0 through 6.3.6 insufficiently preserves the original sender when forwarding mail. A remote unauthenticated attacker can send a message with a From address in a hosted domain, and the server will forward it so that it passes SPF and DMARC checks for that domain at other receivers, even though the message did not originally pass DMARC.

In hMailServer versions 6.2.25 through 6.3.6, missing authorization in the REST metrics route allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns server-wide traffic counters over the last 30 days, which carry no domain information.