CVE Vulnerability Catalog

A Cross-Site Request Forgery (CSRF) vulnerability in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request.

The Xtooltech Xtool AnyScan Android application version 4.40.40 has missing authentication for a critical function. The server-side endpoint responsible for serving update packages does not require any authentication, allowing an unauthenticated remote attacker to freely download official update packages.

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker able to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, directing the application to download a malicious update package.

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is missing SSL certificate validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can perform a man-in-the-middle attack to intercept, decrypt, and modify traffic between the application and the update server, serving as the basis for further attacks including remote code execution.

A reflected cross-site scripting (XSS) vulnerability exists in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0. Attackers can inject a crafted payload into the color parameter to execute arbitrary code in the user's browser.

A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.

Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information by sending a crafted GET request to the /display_logo endpoint.

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API.

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via a crafted POST request to the Npcf_BDTPolicyControl API.

An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via login error messages.

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in tag_key validation logic that fails to enforce exact key-length matching. This allows an attacker with access to these endpoints to manipulate tags and redirect records to unintended destinations. This can lead to injection of forged data and routing manipulation.

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.

The in_forward input plugin in Fluent Bit does not properly enforce the security.users authentication mechanism under certain configuration conditions. Remote attackers with network access to the Fluent Bit instance exposing the forward input can send unauthenticated data.

A use-after-free vulnerability exists in endpoint destructors in Redboltz async_mqtt 10.2.5. It can be triggered by local users through an SSL initialization failure, resulting in incorrect destruction order between io_context and endpoint objects.

Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.

Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL.

NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.

Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_ex_data_X509_STORE_CTX_idx() to return -1.

A NULL pointer dereference exists in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5. A remote attacker can cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.

A NULL pointer dereference exists in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5. A remote attacker can cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL.