CVE Vulnerability Catalog

Authentication bypass vulnerability in JP1/Automatic Job Management System 3. Affects the Manager component from version 10-00 before 13-50-31.

Heap-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects the Manager component from version 10-00 before 13-50-31.

Stack-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects the Manager component from version 10-00 before 13-50-31.

Stack-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects the Manager component from version 10-00 before 13-50-31.

Stack-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects Manager and Agent components from version 11-00 before 13-50-31.

Heap-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects Manager and Agent components from version 11-00 before 13-50-31.

Stack-based buffer overflow vulnerability in JP1/Automatic Job Management System 3. Affects Manager and Agent components from version 11-00 before 13-50-31.

Missing authorization check in the editor controller task in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. The EditorController::getBlogPosts() method reads the order parameter and invokes getBlogPosts(), omitting the GridboxHelper::checkUserEditLevel() check used by other tasks in the controller.

Unauthenticated SQL injection vulnerability in the Joomla Gridbox extension (balbooa.com) before version 2.20.4.2. On store product list pages, the sort-by URL parameter value is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(); when it does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without allowlist validation.

The Qode Membership plugin for WordPress in versions up to and including 2.0.6.2 contains a typographic error in the Facebook OAuth token verification guard ($check_social_useqoder instead of $check_social_user). This causes the guard condition to always evaluate true, rendering the Graph API token verification dead code and allowing unauthenticated attackers to log in as any account, including Administrator, by supplying a login name in the response[email] parameter.

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.

In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the apmib_set function in firewall.so is vulnerable to command injection. The vulnerability can be exploited remotely, and a public exploit is available.

In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the getDeviceInfo function in /var/lib/misc/udhcpd.leases is vulnerable to command injection via manipulation of the MAC address argument. The attack can be launched remotely, and the exploit is publicly available.

In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setCloudUpgradeFW function in lib/cste_modules/upgrade.so is vulnerable to command injection via manipulation of the FileName argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules. This may allow an attacker to obtain elevated Consul privileges.

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with service access privileges to issue database-specific functions that should not be allowed.

A vulnerability in the Burrito Kubernetes operator (Terraform Automation Collaboration Software) prior to 0.13.0 allows the POST /api/webhook endpoint to accept unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value. Anyone who can reach the burrito-server endpoint and knows a tracked repository's URL can forge events to create or delete TerraformPullRequest custom resources with attacker-chosen Branch, Base, and ID fields. For GitHub pull_request events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch, potentially causing an unauthorized terraform plan using the operator's stored git and cloud credentials.

Through 9.0.4, the Rust zip library's ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata. A crafted archive can appear benign to a component inspecting the central directory but cause a streaming extractor to write a different attacker-selected path and content.

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default.