CVE Vulnerability Catalog

A vulnerability in the UniFi Protect Application allows an attacker with network access, under certain conditions, to bypass authentication in UniFi Protect Cameras due to improper initialization.

A vulnerability in UniFi Protect Application allows an attacker with network access to bypass authentication for data streaming due to improper access control.

An Improper Access Control vulnerability in UniFi Protect Application allows a network-accessible attacker to bypass authentication in certain API endpoints.

A Path Traversal vulnerability in self-hosted instances of UniFi Network Application allows an attacker with network access and high privileges to escalate write permissions on the host device.

A vulnerability in UniFi Network Application allows an attacker with network access to execute a Denial of Service (DoS) attack through improper input validation.

An SQL Injection vulnerability in UniFi OS allows an attacker with network access and low privileges to escalate privileges on the affected device or instance.

A Path Traversal vulnerability in devices running UniFi OS allows an attacker with network access to bypass authentication. The flaw affects specific UniFi OS devices or instances.

A vulnerability in UniFi OS allows an attacker with network access and low privileges to execute command injection on the host device due to improper input validation.

An SSRF vulnerability in UniFi OS allows an attacker with network access and low privileges to escalate privileges on the device or instance.

A vulnerability in UniFi Access Application allows privilege escalation on the host device. An attacker with network access and high privileges can exploit improper access control.

In the Linux kernel, a vulnerability was found in the Bluetooth L2CAP subsystem involving lock inversion when closing channels in cleanup_listen(). Instead of calling l2cap_chan_close() directly (which requires conn->lock), the fix schedules a channel timer with zero delay to close the channel asynchronously, preserving the correct lock order.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth stack, occurring during a race between closing a listening socket and HCI connection deletion. The issue involves l2cap_sock_cleanup_listen() and l2cap_conn_del() where a child socket is freed and then accessed without proper reference counting.

A vulnerability in the UniFi Access Application allows an attacker with network access and low privileges to execute command injection on the host device due to improper input validation.

An authenticated SQL Injection vulnerability in UniFi Talk Application allows a network-accessible attacker with low privileges to escalate privileges on the host device.

A vulnerability in the UniFi Connect application allows an attacker with network access to execute command injection on the host device due to improper access control.

An improper validation vulnerability in the `GFAC_Sys_x64.sys` driver of Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.

The vulnerability in the `GFAC_Sys_x64.sys` driver of Little Orbit GFAC allows a local attacker to access privileged driver functions through a Minifilter communication port that lacks proper access restrictions.

A NULL pointer dereference vulnerability in the `GFAC_Sys_x64.sys` driver of Little Orbit GFAC allows a local attacker to cause a denial of service via crafted requests that trigger a system crash.

Missing authentication for a critical function in TR7 Cyber Defense Inc. WAF-ASP allows authentication abuse. The vulnerability affects versions from v1.0.324.900 before v1.4.0.117.

The Divi Form Builder plugin for WordPress up to version 5.1.8 is vulnerable to arbitrary file upload leading to remote code execution. The issue is due to insufficient file extension validation in the do_image_upload() function, where the acceptFileTypes POST parameter is directly interpolated into a regular expression. Attackers can upload files with .phtml, .phar, .php5, or .php7 extensions, bypassing .htaccess protection that only blocks .php files.