CVE Vulnerability Catalog

A denial-of-service vulnerability exists in boot firmware of 5380/5480/5580 controllers prior to version 1.072. It allows a malicious user to write invalid file data to the controller, causing a major non-recoverable fault (MNRF).

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection vulnerability in the optional cli_control plugin. An unauthenticated or CSRF attacker can store a malicious payload via the plugin's HTTP endpoint and then activate an irrigation station, leading to arbitrary OS command execution on the host.

A path traversal vulnerability in Tenable Agent versions 11.2.0, 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution.

A denial-of-service vulnerability in 5380/5480/5580 controllers allows a malicious user to write invalid file data to the device, causing a major non-recoverable fault (MNRF).

A denial-of-service vulnerability in 5370/5570 controllers allows a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.

An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.

The 1715-AENTR EtherNet/IP Adapter exposes a debug port without proper privilege controls, allowing unauthenticated remote attackers to execute intrusive CLI commands. This can lead to reading or deleting files, stopping tasks, modifying memory, and changing I/O states.

In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.

In Apache Doris, certain FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.

A vulnerability in Opcenter X (versions prior to V2604) stems from improper validation of the algorithm in the JWT header. An unauthenticated remote attacker can forge arbitrary JWT tokens, bypass authentication, and impersonate any user, including administrative accounts.

A vulnerability in the Management Server API of XProtect allows users with edit permissions to execute arbitrary code in the context of the Management Server Service.

In DBI::SQL::Nano for Perl versions 1.42 through 1.651, the <= and >= SQL operators are inverted for text comparisons. The <= operator is incorrectly evaluated as 'greater than or equal', and >= as 'less than or equal', causing incorrect WHERE clause filtering.

An insufficient technical documentation vulnerability in Apache Tomcat fails to clearly document the requirements for securely configuring the EncryptInterceptor. This affects multiple Tomcat versions from 7.0.100 through 11.0.23.

A vulnerability in Apache Tomcat's rewrite valve allows security constraint bypass due to improper handling of URL hex encoding. Affected versions include 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0-M1 through 9.0.119, and 8.5.0 through 8.5.100.

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using MongoDB backend are vulnerable to unauthenticated arbitrary file write via the AAS thumbnail API. An attacker can upload a file with a controlled filename and then trigger retrieval, writing the content to any path on the server filesystem.

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) prior to version 3.2.1 allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. Exploitation can occur via crafted OAuth token request URLs, malicious files in ingestion pipelines, SQL injection via staging options in shared Spark environments, or runtime SET commands in shared Spark-SQL sessions.

The Word Count and Social Shares WordPress plugin through version 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks. This allows any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g., by deleting wp-config.php).

SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.

An authenticated attacker can exploit logical errors in memory management in SAP NetWeaver Application Server ABAP, causing memory corruption. This could lead to unauthorized data access, modification, or system unavailability.