CVE Vulnerability Catalog

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.

SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer, allowing controlled data to be written beyond buffer boundaries and potentially enabling code execution.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1 in the plugin_init function of /tmp/upload_files within the PPPoE WAN Setting Handler component. Manipulating the pppd_options argument leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.

A flaw was found in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the L2TP Authentication component. Manipulating the Username argument causes CRLF injection. The attack can be launched remotely and a public exploit is available.

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of /etc/ipsec.conf within the IPsec Policy Handler component. Manipulating the secproto argument results in CRLF injection. The attack can be launched remotely and the exploit is public.

A security vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Dnsmasq component. Manipulating the rent_time argument leads to CRLF injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall version 26.7.1_1 and earlier, allowing a low privileged attacker to execute JavaScript in the context of another user visiting a specific page or clicking on a specifically crafted link.

Pleasanter fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

The Meow Apps AI Engine plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.6.

The FunnelKit Automations plugin (wp-marketing-automations) by Aman contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects FunnelKit Automations from n/a through 3.8.5.2.

The VillaTheme DEPART plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects DEPART from n/a through 1.0.10.

A vulnerability in the Apache Camel CoAP component allows sensitive information disclosure in error responses. When the CoAP consumer fails to build its response after the route completes, the resulting exception is caught and its message — containing class names, file paths, host names, and connection details — is sent back to the CoAP client as the payload of a 5.00 Internal Server Error response.

The Ash library (ash-project) contains an Authorization Bypass Through User-Controlled Key vulnerability. Under attribute multitenancy, create actions with upsert? true could update another tenant's records and return their attributes, and default upsert fields moved the record into the caller's tenant. The issue affects versions from 1.22.0 before 3.37.2.

A weakness was identified in Oray Pugongying X5 Pro 7.6.1 affecting the snmp_set function of the SNMP Handler component. Manipulating the info.community argument can lead to CRLF injection. The attack can be launched remotely and a public exploit is available.

A security flaw was discovered in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Ser2net component. Manipulating the regmsg argument results in CRLF injection. The attack can be initiated remotely and the exploit has been publicly released.

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to version 1.24.0.3 in an unknown function of the Workshop Scenario Loader component. Manipulation leads to deserialization, and the attack can be performed remotely. Upgrading to version 1.24.0.4 fixes the issue.

In ffxiv-teamcraft FFXIV Teamcraft up to version 11.4.31, the clipboard.readText function in apps/electron/src/preload.ts of the Renderer-Process IPC Bridge component is vulnerable. Manipulation causes cross site scripting, and the attack can be carried out remotely. The exploit has been publicly disclosed, and the fix is in version 11.4.32.