CVE Vulnerability Catalog

A vulnerability was found in Tenda AC9 and AC15 version 15.03.05.14 affecting the formexeCommand function in /goform/exeCommand. Manipulating the cmdinput argument leads to OS command injection. The flaw can be exploited remotely and a public exploit is available.

A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected is the function sub_433F7C of the file version_upgrade.asp of the jhttpd component. Manipulation of the path argument results in OS command injection. The attack may be launched remotely and the exploit has been made public.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata, allowing authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing.

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization. Malicious or compromised remote clusters can access sensitive user information via unsanitized user objects. The vulnerability affects Mattermost Server instances with shared channels enabled.

A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected is the function sub_4621DC of the file usb_paswd.asp of the jhttpd component. Manipulation of the hname argument leads to OS command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.

During a short time frame while the device is booting, the switch operates in an undefined state, allowing an unauthenticated remote attacker to send traffic to unauthorized networks. A CPU-induced reset is required for proper configuration.

In newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7, the paySuccess function in /paySuccess (Order Status Handler component) is vulnerable to manipulation of the orderNo argument leading to improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed.

A SQL injection vulnerability was detected in SourceCodester Student Grading System 1.0 in file /form137.php. Manipulation of the ID argument allows remote attack. The exploit is public and may be used.

A ReDoS vulnerability was discovered in the Hugging Face Transformers library in the normalize_numbers() method of the EnglishNormalizer class. It affects versions up to 4.52.4 and is fixed in 4.53.0. Crafted input with long digit sequences can cause excessive CPU consumption.

A vulnerability was detected in CRMEB up to version 5.6.1 in the testOutUrl function of app/services/out/OutAccountServices.php. Manipulation of the push_token_url argument leads to Server-Side Request Forgery (SSRF). The exploit has been publicly disclosed and can be used remotely. The vendor did not respond.

In CRMEB up to 5.6.1, the editAddress function in app/services/user/UserAddressServices.php allows manipulation of the ID argument, leading to improper authorization. The attack can be launched remotely and the exploit is publicly available.

A security flaw was discovered in CRMEB up to 5.6.1 impacting the Save function of app/services/system/admin/SystemAdminServices.php in the Administrator Password Handler component. Manipulating the ID argument results in improper authorization, and the attack may be initiated remotely. The exploit has been publicly released.

A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1. This vulnerability affects unknown code of the file /handshake.php. This manipulation of the argument machine_name/computer_user/os/date/time/ip/location/systemid/password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Liferay Portal and Liferay DXP contain an open redirect vulnerability in System, Instance, and Site Settings. Remote attackers can redirect users to arbitrary external URLs via specific redirect parameters.

A flaw in Wavlink WL-WN578W2 (version 221110) in the file /live_online.shtml leads to information disclosure. The attack can be executed remotely and the exploit has been published.

An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account information, balances, transaction history, and unspecified other information. The supplier claims this is an intended feature and does not reveal much sensitive data.

A stored cross-site scripting (XSS) vulnerability exists in Liferay Portal and Liferay DXP within organization site names. A remote authenticated attacker can inject JavaScript that is stored and executed without proper sanitization or escaping.

OpenSynergy BlueSDK (aka Blue SDK) through 6.x has improper input validation within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of the remote L2CAP channel ID (CID), allowing an attacker to create an L2CAP channel with the null identifier assigned as a remote CID.

In the Linux kernel, a vulnerability was found in the blk_stack_limits() function in the block layer, where the chunk_sectors check could cause an unsigned integer overflow when converting to bytes. The fix changes the check to be sector-based.

W jądrze Linuxa rozwiązano podatność związaną z architekturą ARM, dotyczącą użycia funkcji memcpy do zapisu w IRAM. Problemy występowały, gdy Kasan próbował sprawdzić granice podczas używania standardowej funkcji memcpy.