CVE Vulnerability Catalog

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

A weakness has been identified in Osclass up to 8.3.1. Affected is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the Item Model Handler component. Manipulation of the sPattern argument causes SQL injection. The attack may be initiated remotely and the exploit has been made public. The vendor was contacted early but did not respond.

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query, allowing an attacker to read data from the database. The issue affects every searched field.

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

The vulnerability in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1 involves pass-through of unvalidated KMS URLs to KMS clients. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation, potentially sending a KMS token to a malicious host.

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.

A NULL pointer dereference vulnerability in the logs management functionality. An unauthenticated attacker could exploit this flaw to crash the service.

A buffer overflow vulnerability in the password verification functionality. An attacker with guest authentication could exploit this flaw to achieve code execution.

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine results in acceptance of unauthenticated dynamic data updates during the Autoupdate routine.

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file. This could potentially compromise the device permanently.

A stack-based buffer overflow vulnerability in the logs settings functionality. An authenticated attacker could exploit this flaw to achieve code execution.

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files. It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS.