CVE Vulnerability Catalog

A post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1 could allow for a denial of service attack induced by improper handling of exceptional conditions.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data, allowing a system admin to crash the server via the bulk import feature.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names, allowing users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

In jshERP v3.5, the component PersonController.java has incorrect access control, allowing unauthorized attackers to obtain all handler information by executing the getAllList method.

In jshERP v3.5, the SupplierController.java component has an incorrect access control vulnerability, allowing unauthorized attackers to arbitrarily modify supplier status on any account.

In jshERP v3.5, incorrect access control in the UserController.java component allows attackers to arbitrarily reset user account passwords. This vulnerability enables a horizontal privilege escalation attack.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize path traversal sequences in template file destination paths. A system admin can perform path traversal attacks via malicious path components, potentially enabling malicious file placement outside intended directories.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2, and 10.10.x <= 10.10.0 fail to validate upload types in remote cluster upload sessions. A system admin can upload non-attachment file types via shared channels that could potentially be placed in arbitrary filesystem directories.

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, and 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint. This allows a team admin without member invite privileges to obtain the team's invite ID.

Mattermost versions 10.9.x <= 10.9.1, 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, and 9.11.x <= 9.11.17 fail to properly validate file paths during plugin import operations. This allows restricted admin users to install unauthorized custom plugins via path traversal, bypassing plugin signature enforcement and marketplace restrictions.

A vulnerability was found in Portabilis i-Educar up to 2.10 in the file /intranet/educar_tipo_usuario_lst.php. Manipulation of the nm_tipo/descrição arguments leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 2.12 fixes this issue.

A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This is due to improper validation of the file copy function, enabling arbitrary file uploads.

The elysia-cors library through version 1.3.0 has an origin validation error that allows bypassing CORS restrictions. Instead of exact domain matching, the library checks if the supplied origin is a substring of any domain in the CORS policy, enabling attackers to use malicious origins like "notexample.com" or "example.common.net" when the policy includes "example.com".

A vulnerability in the libssh library involves an integer overflow in the bin_to_base64() function when processing an unexpectedly large input buffer passed to ssh_get_fingerprint_hash(). This leads to memory under-allocation and out-of-bounds write, causing heap corruption. The issue affects only 32-bit builds of libssh.

There's a vulnerability in the CRI-O application where when a container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running on the same host.

Firefox Focus for Android has a spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142.

A spoofing issue has been identified in the Address Bar component of the Firefox browser. The vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

In Firefox (version 141) there is a spoofing vulnerability that can be exploited via a crafted URL using a blob: URI, hiding the true origin of the page. This issue only affects Android. The vulnerability was fixed in Firefox 141.

In Firefox for Android, the address bar truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.