CVE Vulnerability Catalog

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contain an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archives and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.

SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page. The description does not provide further technical details.

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket, and the daemon does not automatically restart, resulting in a persistent denial of service.

A vulnerability was identified in iFlytek astron-agent up to 1.1.2 affecting the FileInfoV2Service.listKnowledgeByPage function in FileInfoV2Service.java of the Console Knowledge-List Endpoint component. Manipulation of the space-id argument leads to authorization bypass, and the attack may be launched remotely. The exploit is publicly available, and the vendor did not respond to the disclosure.

A vulnerability was found in iFlytek astron-agent up to 1.1.2 affecting an unknown function in core/memory/database/api/v1/exec_ddl.py within the DDL Whitelist Handler component. The manipulation results in an incomplete blacklist and can be triggered remotely. The exploit has been publicly disclosed and the vendor did not respond.

A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store contains recoverable eMudhra intermediate CA certificates. The issue impacts mongosh versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0, which bundles Node.js 24.22.1 or later.

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key that lets an attacker within Bluetooth range decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

Apache SIS from version 0.7 through 1.6 opens files referenced by processed data regardless of their paths, potentially allowing a local file path to be specified. This affects GML with xlink:href attributes, WKT with datum shift grid parameter elements, and Landsat scenes with GeoTIFF band file paths. Reading stops at the first parsing error, making sensitive information leakage unlikely.

In the SQL storage module of Apache SIS, when sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafted sort clause could inject SQL into the query. This affects the sql-storage module from version 1.0 through 1.6; other modules such as sis-referencing are not impacted.

An issue in the WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. The description does not provide further technical details.

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers; affects versions from 2.0.0-beta.1 before 4.9.0.

A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.

Mattermost versions <=11.9, 11.1.9, 11.5.8, 11.10.7.0 fail to validate Zoom chat line length before slicing, which allows an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription containing short continuation lines.

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls.

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.