CVE Vulnerability Catalog

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

In Jetty's HttpClient, when a request is made through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy and re-sends the request with the Proxy-Authentication header, which reaches the server and exposes the proxy credentials to it.

In Eclipse Jetty, HttpClient may receive a redirect of the form /secure/../evil. If an attacker controls the redirects, HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and therefore follows the redirect sending the Authorization header for /secure to /evil.

The WebCTI service for Slican IPx telephone exchanges stores temporary subscriber passwords in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

The WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in the /webcti/admin_json.php endpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.

Slican telephone exchanges use symmetric encryption for TCP/IP communication, and the secret key is hardcoded in multiple binary files. An attacker with access to these files can decrypt the communication.

In Eclipse Jetty, across various versions of jetty-annotations and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation and web.xml defined security-constraint on the same url-pattern were not applied if the web.xml had more than one url-pattern for a servlet and a security-constraint applied to only some of those url-pattern definitions.

A weak password recovery mechanism for forgotten passwords in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators can read and write the management file, but it is protected by Windows.

In undici (an HTTP client library for Node.js) versions 8.11.0 and 8.11.1, its experimental WebSocket client, enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits.

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash.

In Rancher, a user with the ability to create a project on a certain cluster can create a project with the same name as an existing project in a different cluster. This results in the user gaining access to the other project in the different cluster, leading to privilege escalation, because the namespace used on the local cluster to store related resources (PRTBs and secrets) is the name of the project.

In Steve, by default an insecure option was used that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.

In bhyve's framebuffer device model, maximum resolution constants were duplicated between the framebuffer and RFB modules and got out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized.

In bhyve's HDA audio device model, zero-length Buffer Descriptor List (BDL) entries were not checked when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields could also be modified by the guest after validation.

In bhyve's xHCI (USB 3) device model, the event ring size provided by the guest was not validated or saved. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code.

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() function, which allows user-controlled PHP code to be written to executable files in the uploads directory.

A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.