CVE Vulnerability Catalog

An Integer Overflow vulnerability exists in FortiOS, FortiProxy, and FortiPAM that may allow an authenticated user to affect the device's SSL-VPN availability via crafted requests.

Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

In Intel TDX module software before version TDX_1.5.07.00.774, an out-of-bounds read may allow an authenticated user to potentially enable information disclosure via local access.

In WuKongOpenSource WukongCRM 11.0, a vulnerability in the /adminFile/upload file of the API Response Handler component leads to information exposure through error messages. The attack can be performed remotely, and exploit details are publicly available.

Operator-SDK before version 0.15.2 includes a user_setup script that sets /etc/passwd permissions to 664 (group-writable) with root group ownership (gid=0) during build time. An attacker with access to the container, even as a non-root user, can leverage membership in the root group to modify /etc/passwd and add a user with arbitrary UID, including 0, leading to full root privileges within the container.

An issue in 4C Strategies Exonaut before version 22.4 allows attackers to perform a directory traversal attack. This vulnerability enables reading files outside the intended directory.

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. An attacker can inject malicious JavaScript code that executes in the victim's browser.

An SSRF vulnerability in Vedo Suite 2024.17 allows authenticated attackers to send HTTP requests to arbitrary external paths via the "file" parameter in the /api_vedo/video/preview endpoint.

A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'.

A vulnerability in Vedo Suite 2024.17 allows unauthenticated remote attackers to obtain a valid high-privilege JWT token by sending an empty HTTP POST request to the /autologin/ endpoint, due to incorrect access control.

A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavaScript or HTML code, potentially leading to code execution in the victim's browser.

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'.

An access control issue was discovered in 4C Strategies Exonaut prior to version 22.4, which may allow unauthorized users to access resources without proper permissions.

A Server-Side Request Forgery (SSRF) vulnerability was discovered in 4C Strategies Exonaut prior to version 21.6.2.1-1. This allows an attacker to send requests from the server to internal network resources.

Insecure permissions were discovered in 4C Strategies Exonaut prior to version 22.4, potentially allowing unauthorized access to resources.

A vulnerability was found in Keycloak-services where special characters used during email registration may perform SMTP Injection and unexpectedly send short unwanted emails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very short emails (subject and little data, the example is 60 chars). The only direct consequence is an unsolicited email being sent from the Keycloak server, but this could be a precursor for more sophisticated attacks.

MCCMS v2.7.0 has an SSRF vulnerability in the index() method of sys\apps\controllers\api\Gf.php, where the pic parameter is processed. The parameter is decrypted using sys_auth() with a hard-coded key and the decrypted URL is passed to geturl(), which performs a cURL request without proper security checks. An attacker can craft a malicious encrypted pic parameter pointing to internal addresses or local paths (e.g., http://127.0.0.1 or file://), enabling access to internal services and arbitrary local file reads.

In SSCMS version 7.3.1, the component /stl/actions/download?filePath is vulnerable to directory traversal. This allows an attacker to read arbitrary files outside the intended directory.