CVE Vulnerability Catalog

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contain a stored XSS vulnerability via the remark parameter in /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /cgi-bin/incoming.cgi. An authenticated attacker can inject JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the dscp parameter in /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the name parameter in /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark user ham spam parameter in /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

In Endian Firewall version 3.3.25 and prior, a stored XSS vulnerability was found in the remark parameter in /manage/dhcp/fixed_leases/. An authenticated attacker can inject JavaScript that executes when other users view the page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the NAME parameter in /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

Endian Firewall version 3.3.25 and prior contains a stored XSS vulnerability via the remark parameter in /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.

phpMyFAQ prior to version 4.1.1 contains a stored XSS vulnerability via Regex Bypass in Filter::removeAttributes(). This issue has been patched in version 4.1.1.

In Glances prior to 4.5.3, the XML-RPC server sends Access-Control-Allow-Origin: * on every HTTP response and does not validate the Content-Type header. An attacker-controlled webpage can issue a CORS simple request with a valid XML-RPC payload and read the full system monitoring dataset.

phpMyFAQ prior to 4.1.1 allows an unauthenticated attacker to submit a guest FAQ with an RFC 5321-valid email address (quoted local part) containing raw HTML, such as "<script>alert(1)</script>"@evil.com. FILTER_VALIDATE_EMAIL accepts it, the email is stored without sanitization, and it is rendered in the admin FAQ editor using Twig's |raw filter, bypassing auto-escaping. This is patched in 4.1.1.

In Tenda G103 1.0.0.5, the action_set_system_settings function in system.lua (Setting Handler component) does not neutralize the lanIp argument, leading to command injection. The attack can be performed remotely and the exploit has been publicly disclosed.

CocoaMQTT before 2.2.2 has a packet parsing vulnerability that allows an attacker (or compromised MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes a 4-byte malformed payload to a shared topic with RETAIN set, the broker persists it and automatically pushes it to any subscribing client, instantly crashing the app in the background. Fixed in 2.2.2.

A vulnerability in Progress Flowmon versions prior to 12.5.8 and 13.0.6 allows an attacker to trick an administrator into clicking a malicious link, potentially triggering unintended actions within their authenticated web session.

Szafir SDK Web is a browser plug-in that can run the SzafirHost application, which downloads necessary files when launched. It is possible to change the URL (HTTP Origin) of the application call location — an unauthenticated attacker can craft a website that launches SzafirHost with arbitrary arguments via the addon. No validation checks whether the address in the 'document_base_url' parameter relates to the actual calling web application; the address is shown in the confirmation prompt, and once confirmed the application runs in the context of the attacker's site and may download additional files and libraries. If the victim previously accepted execution with the 'remember' option, the prompt is not shown and the application is launched without interaction. The issue was fixed in version 0.0.17.4.