CVE Vulnerability Catalog

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access. Clients whose class-level permissions or object ACLs allow update but not read can see object data, including atomic operation results, Cloud Code trigger-set values, and whole parent fields under dot notation in certain conditions.

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams. Attackers can return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F), so authorization checks use the Nuxt helper value while resource selection uses event.context.params.

A security flaw was discovered in samanhappy MCPHub up to 1.0.45/1.1.7 in src/utils/passthroughHeaders.ts. Manipulation of the passthroughHeaders argument results in information disclosure, and the attack can be launched remotely. Upgrading to version 1.1.8 is recommended.

A vulnerability was identified in Termix-SSH Termix up to 2.9.2 affecting the /plugin-api/file-manager/transferToHost endpoint. Manipulation of the destPath argument leads to path traversal, and the attack can be launched remotely. The exploit is publicly available and may be used.

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2 affecting WorkflowExecutor.restore_context in app/chain/workflow.py. Manipulation can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x affecting TradeRefundService.updateAmound in the publiccms-trade component. Manipulation of the refundId argument results in authorization bypass, and the attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability was identified in Linksys E8450 version 1.2.00.360516 in the strcpy function of /www/cgi-bin/portal.cgi. Manipulation of the hidden_timezone argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the vendor did not respond to the disclosure.

A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.

A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.

A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.

A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.

A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416d48/sub_41a7c0 functions of the /bin/ioos file, within the VPN client list handler component. Manipulation of the opt argument results in missing authentication. The attack can be initiated remotely and the exploit is now public.

A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.

A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.

Apache Wicket generates JavaScript that references rendered elements, placing markup ids and form input names inside single-quoted JavaScript string literals without proper escaping. A value containing a single quote or backslash can terminate the literal and inject script that runs in the application's origin when the page loads. The issue affects wicket-core and wicket-extensions in versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0.

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly.

A cross-site scripting (XSS) vulnerability in Apache Wicket arises from improper neutralization of input during web page generation. The ExternalLink component, when bound to a non-anchor element, concatenates the model URL into a JavaScript string literal in the onclick attribute without proper escaping, allowing script execution in the application's origin.

Apache Wicket has an incorrect behavior order: a file path is validated by PackageResourceGuard before the framework appends the style, variation and locale attributes. As a result, the file opened may differ from the file approved by the guard, allowing disclosure of HTML markup templates of components whose class names contain an underscore (e.g. Report_v2).

In Apache Wicket, PackageResourceGuard incorrectly allows component markup templates to be served as package resources when wicket-core is loaded by a class loader that cannot see the application's classes. In such a setup the check for a class file beside the template fails, and a request for the package resource URL returns the component's markup template with status 200. Disclosed content is developer-authored template material such as component structure, comments, inline script, and named endpoints.

A vulnerability in Apache Wicket affects AbstractFileUploadResource, the server side of the form-less upload offered by FileUploadToResourceField. The request size, single-part size and part-count limits are taken from request parameters (maxSize, fileMaxSize, fileCountMax) instead of application configuration, so a client can raise or omit them. The resource carries no authorization annotation, so by default requests need no authentication.