CVE Vulnerability Catalog

A command injection vulnerability exists in the D-Link DIR-882 router firmware DIR882A1_FW102B02 within the prog.cgi and rc binaries. User-supplied email configuration parameters are stored in NVRAM and later concatenated into shell commands without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.

A command injection vulnerability exists in the D-Link DIR-882 router firmware DIR882A1_FW102B02 within the prog.cgi and librcm.so binaries. The SetDMZSettings/IPAddress value is stored in NVRAM and later concatenated into iptables shell commands without sanitization, allowing an unauthenticated remote attacker to execute arbitrary commands.

A stack-based buffer overflow exists in the get_merge_mac function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). The function concatenates up to six user-supplied CGI parameters matching <parameter>_0~5 into a fixed-size buffer (a2) without proper bounds checking, appending colon delimiters during concatenation. Remote attackers can exploit this vulnerability via specially crafted HTTP requests to execute arbitrary code or cause denial of service without authentication.

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823G_V1.0.2B05_20181207.bin in the timelycheck and sysconf binaries, which process the /var/system/linux_vlan_reinit file. The vulnerability occurs because content read from this file is only partially validated for a prefix and then formatted using vsnprintf() before being executed with system(), allowing an attacker with write access to /var/system/linux_vlan_reinit to execute arbitrary commands on the device.

Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, allowing a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses.

Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server. This may result in interception of authentication data.

A stack-based buffer overflow vulnerability exists in the mtk_dut binary of Linksys E7350 routers (Firmware 1.1.00.032). The function sub_4045A8 reads up to 256 bytes from /sys/class/net/%s/address into a local buffer and copies it into caller-provided buffer a1 using strcpy without boundary checks. Since a1 is often allocated with significantly smaller sizes (20-32 bytes), local attackers controlling the contents of /sys/class/net/%s/address can trigger buffer overflows.

A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user.

A vulnerability in the web-based management interface of Cisco Catalyst Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This is due to insufficient validation of user input. An attacker could exploit this by persuading a user to click a crafted link, potentially allowing execution of arbitrary script code or access to sensitive browser-based information.

A vulnerability in the REST API of Cisco Catalyst Center could allow an authenticated, remote attacker to execute arbitrary commands in a restricted container as the root user. This is due to insufficient validation of user-supplied input in REST API request parameters. The attacker must have valid credentials for an account with at least the Observer role.

A vulnerability in Cisco Catalyst Center could allow an authenticated, remote attacker to execute operations that should require Administrator privileges. The attacker would need valid read-only user credentials. This is due to improper role-based access control (RBAC).

In Keycloak's server distribution, enabling debug mode (--debug <port>) insecurely defaults to binding the JDWP port to all network interfaces (0.0.0.0), exposing the debug port to the local network.

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).

PrivateBin versions 1.7.7 through before 2.0.3 contain an unauthenticated Local File Inclusion in the template-switching feature. If templateselection is enabled, the server trusts the template cookie and includes the referenced PHP file, potentially allowing sensitive data disclosure or remote code execution. Fixed in version 2.0.3; workaround is to set templateselection = false.

MaxKB, an enterprise AI assistant, prior to version 2.3.1 allows a user to obtain sensitive information via Python code in the tool module, even though the process runs in a sandbox. Version 2.3.1 fixes the issue.

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilize on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used without sanitization to build the URL. This leads to middleware-based protected route bypass, DoS via cache poisoning, SSRF, URL pollution (potential SXSS), and WAF bypass. Version 5.15.5 contains a patch.

An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers. User-supplied CGI parameters are concatenated into system command strings without proper sanitization and executed via wl_exec_cmd.

A stack buffer overflow vulnerability was found in the setDefResponse function of the cstecgi.cgi binary in ToToLink LR1200GB and NR1800X routers. An unauthenticated attacker can send a crafted "IpAddress" parameter, causing a buffer overflow that may lead to arbitrary code execution.

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long, then directly inserts it into a system command using sprintf() and executes it with system().

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R, LR1200GB, NR1800X). The programs parse /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation, allowing an attacker to write beyond buffer boundaries.