CVE Vulnerability Catalog

The Joomla extension J-BusinessDirectory before version 6.2.3 contains a DoS vulnerability in pagination parameter handling. Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limit was not validated before use in list queries.

SQL injection vulnerability in Joomla extension J-BusinessDirectory (cmsjunkie.com) before version 6.2.3. In trips search, search keywords and ORDER BY were concatenated into SQL. Version 6.2.3 quotes keywords and allow-lists the sort clause.

The J-BusinessDirectory extension for Joomla before version 6.2.3 contains a vulnerability allowing arbitrary file upload/deletion via path traversal. The _path_type parameter can point to component site/admin trees, and the extension check is weak. CSRF token is also missing on upload/remove.

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

Cudy WR3000 2.0 with firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret in the Mosquitto MQTT broker's authentication plugin. An unauthenticated attacker can extract the secret from the firmware image and forge valid JWT tokens, gaining unauthorized access to the device's mesh networking interface.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low privileged attacker with remote access could exploit this, leading to information exposure.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could exploit this, leading to filesystem access.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Ground Station before version 0.4.13 contains a vulnerability in the unauthenticated save-waterfall-snapshot Socket.IO command. An attacker can control the snapshotName input, allowing file writes outside the data directory via path traversal. It is possible to write a YAML logging configuration file that, during service restart, executes arbitrary code (RCE) with service privileges.

Formie, a Craft CMS plugin for creating forms, before version 3.1.27 passes request-derived Hidden field defaults (e.g., User Agent, URL, query parameters) to Craft's Twig rendering layer. An unauthenticated attacker can place Twig syntax in these values, leading to server-side template evaluation (SSTI), potentially resulting in information disclosure, application state modification, or remote code execution.

jxl-oxide, a pure Rust implementation of a JPEG XL decoder, prior to jxl-grid 0.6.2, contains a vulnerability in length calculations on 32-bit platforms when decoding a crafted JPEG XL image. This can lead to out-of-bounds writes, memory corruption, denial of service, or arbitrary code execution.

Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

The SimpleSAMLphp SAML2 library in versions 4.19.2 and 4.20.2 allows attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service. This issue is fixed in versions 4.19.3 and 4.20.3.

The SimpleSAMLphp SAML2 library prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1 has a vulnerability in the HTTPArtifact::receive() flow that can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. In a multi-IdP federation, a malicious or lower-trust IdP can impersonate a higher-trust victim IdP and authenticate as arbitrary users. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

electerm prior to version 3.11.11 constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, leading to arbitrary command execution with the desktop user's privileges. This issue is fixed in version 3.11.11.