CVE Vulnerability Catalog

A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB and NR1800X router firmware in the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation, potentially leading to arbitrary code execution or memory corruption without authentication.

A command injection vulnerability exists in the ToToLink A720R router firmware V4.1.5cu.614_B20230630 within the sysconf binary. The sub_40BFA4 function handling network interface reinitialization from '/var/system/linux_vlan_reinit' only partially validates input and concatenates it into shell commands executed via system() without escaping, allowing arbitrary command execution.

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell commands and executed via system() without any sanitization or escaping. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device.

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs.

In mruby up to 3.4.0, the sort_cmp function in src/array.c contains a use-after-free vulnerability that can be exploited locally. The exploit has been publicly disclosed.

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to disclose information via local access.

Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.

Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.

Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.

The Zoom Workplace VDI Plugin macOS Universal installer before versions 6.3.14, 6.4.14, and 6.5.10 in their respective tracks follows symbolic links. An authenticated user may exploit this to disclose information via network access.

A cross-site request forgery (CSRF) vulnerability was found in Simple E-Banking System 1.0. An attacker can remotely force a logged-in user to perform unintended actions. The exploit has been publicly disclosed and may be used.

The paySuccess function in /order/paySuccess of mall-swarm up to 1.0.3 has an improper authorization flaw. Manipulating the orderID argument allows unauthorized marking of orders as paid. The exploit is public and the vendor did not respond.

A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. The cancelOrder function in /order/cancelOrder is affected; manipulation of the orderId argument leads to improper authorization. The attack can be initiated remotely, the exploit has been disclosed publicly, and the vendor did not respond.

Insecure Direct Object Reference (IDOR) vulnerability in DeporSite by T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in '/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos', which could lead to the exposure or alteration of confidential data.

A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. The cancelUserOrder function in /order/cancelUserOrder is affected; manipulation of the orderId argument can lead to improper authorization. The attack can be launched remotely, the exploit is publicly available, and the vendor did not respond.

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in macrozheng mall-swarm up to version 1.0.3 in the updateAttr function of the file /cart/update/attr. Manipulation leads to improper authorization. The attack can be performed remotely, and the exploit is publicly available.

A Reflected Cross-site Scripting (XSS) vulnerability has been discovered in xCally's Omnichannel v3.30.1. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the 'failureMessage' parameter in '/login'. This can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.