CVE Vulnerability Catalog

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

A missing authentication vulnerability exists in FireCluster Sync processing. An attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, can invoke privileged firewall management actions as root by sending a specially crafted request.

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

A vulnerability was found in node-tesseract up to version 0.2.7 in the process function of lib/tesseract.js (Command Builder component). Manipulating the image argument leads to OS command injection, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used; the project has not yet responded to the issue report.

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. Manipulation of the weight_map argument causes path traversal. The exploit has been published and may be used; the project has not responded to the issue report.

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely, and the exploit is now public and may be used; the project has not responded to the issue report.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Tribulant Software Newsletters (newsletters-lite). This issue affects Newsletters from n/a through 4.18.2.

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user's VPN username and password.

A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server can create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who controls or intercepts traffic to the configured Active Directory server can create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response.

An integer overflow exists in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83. A malicious remote host may cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

A race condition exists in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1. A local authenticated attacker with low privileges can execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.