CVE Vulnerability Catalog

In the Wahoo Fitness SYSTM app on Android up to version 7.2.1, the file BuildConfig.java uses a hard-coded cryptographic key (SEGMENT_WRITE_KEY). The exploit is publicly available and the vendor has not responded.

In the Individuals & Pro App on Android up to version 2.1.7, a vulnerability was found in the file BuildConfig.java in the component com.afone.noelse. Manipulation of the SEGMENT_WRITE_KEY argument leads to use of a hard-coded cryptographic key. Local access is required.

In the AgentNet Singapore App on Android up to version 23.7.10, a vulnerability was found in the file BuildConfig.java in the component com.allproperty.android.agentnet. Manipulation of the SEGMENT_ANDROID_WRITE_KEY/SEGMENT_TOS_WRITE_KEY arguments leads to use of a hard-coded cryptographic key. Local access is required.

In My Invisalign App 3.12.4 on Android, in the BuildConfig.java file of the com.aligntech.myinvisalign.emea component, manipulation of the CDAACCESS_TOKEN argument leads to use of a hard-coded cryptographic key. Local access required, exploit publicly available. Vendor did not respond.

In Dialogue App up to version 4.3.2 on Android, in the res/raw/config.json file of the ca.diagram.dialogue component, manipulation of the SEGMENT_WRITE_KEY argument leads to use of a hard-coded cryptographic key. Local access required, exploit publicly available. Vendor did not respond.

A vulnerability was found in GRID Organiser App up to 1.0.5 on Android in the file res/raw/app.json. Manipulation of the SegmentWriteKey argument results in use of a hard-coded cryptographic key. The attack requires local access.

A vulnerability was found in Rico só vantagem pra investir App up to 4.58.32.12421 on Android in the file br/com/rico/mobile/di/SegmentSettingsModule.java. Manipulation of the SEGMENT_WRITE_KEY argument leads to use of a hard-coded cryptographic key. The attack requires local environment.

An issue was discovered in Roundcube Webmail before versions 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

A vulnerability was found in UCC CampusConnect App up to 14.3.5 on Android in the file campusconnect/BuildConfig.java. Manipulation leads to use of a hard-coded cryptographic key. The attack requires local execution.

Roundcube Webmail before versions 1.5.14 and 1.6.14 has an unsafe deserialization vulnerability in the redis/memcache session handler, which can lead to arbitrary file write operations by unauthenticated attackers.

In Shinrays Games Goods Triple App up to version 1.200, the file jRwTX.java uses a hard-coded cryptographic key (AES_IV/AES_PASSWORD). Local attack with high complexity, exploit published. Vendor did not respond.

In Ella Core prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API does not verify that the IMSI from the URL path matches the IMSI from the JSON request body. An authenticated NetworkManager can modify any subscriber's policy while the audit trail records a fabricated IMSI. This is fixed in version 1.8.0.

A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker may be able to cause unexpected app termination.

Newgen OmniDocs up to version 12.0.00 has a vulnerability in the file /omnidocs/GetWebApiConfiguration where manipulation of the connectionDetails argument leads to information disclosure. The attack is remote, with high complexity, and the exploit is publicly available.

A vulnerability in krayin laravel-crm up to version 2.2 in the composeMail function of the inbox.spec.ts file in the Activities and Notes modules allows XSS attacks. The attack can be performed remotely, and the exploit is publicly available.

Free5GC 4.2.0 has a type confusion vulnerability in the aper component, exploitable remotely but with high complexity.

OpenSSH before version 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions, potentially allowing unauthorized access.

In OpenSSH before version 10.3, listing any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to allow all ECDSA algorithms.

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configuration of % in ssh_config.

A multipart content smuggling vulnerability was found in Rack (Ruby) before versions 2.2.23, 3.1.21, and 3.2.6. Rack selects the last boundary parameter instead of the first, which can bypass WAF filters.