CVE Vulnerability Catalog

A vulnerability was detected in Unitree Robotics Unitree Go2 up to version 1.1.11.4. The set_volume function in gpt_thread.py of the chat_go component mishandles the Value argument, leading to OS command injection. The attack can be launched remotely, and upgrading to version 1.1.11.5 resolves the issue.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

A vulnerability was detected in phpIPAM up to 1.8.3 in the create_rack_link function of app/tools/racks/show-rack-popup.php (Rack Link Creation component). Manipulation of the deviceid argument results in cross site scripting. The issue can be exploited remotely and a public exploit is already available.

A security vulnerability was detected in phpIPAM up to 1.8.3 in an unknown functionality of upgrade/index.php. Manipulation of the REQUEST_URI argument leads to cross site scripting. The attack can be launched remotely and the exploit has been publicly disclosed.

In FaveoSuite Faveo Helpdesk 2.0.3, the ForgotPasswordController::sendResetLinkEmail/PasswordController::reset function in app/Http/Controllers/Auth/ForgotPasswordController.php leads to weak password recovery. The attack may be initiated remotely.

Vulnerability in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is easily exploitable by an unauthenticated attacker with network access, leading to unauthorized creation, deletion, or modification of critical data as well as unauthorized access to critical data. The vulnerability also applies to Java deployments that load and run untrusted code in a sandbox (e.g., Java Web Start applications or applets).

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 affecting the UnAuthController.changeStatus/close/open/resolve functions in app/Http/Controllers/Client/helpdesk/UnAuthController.php. Manipulating the id/status arguments leads to missing authorization, and the attack can be launched remotely.

A vulnerability was found in Travisun Opptrix 0.4.0 affecting the Buffer.concat function of the /api/channels/webhook/ file in the preParsing handler component. Manipulation results in denial of service, and the attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability was found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/system-update/import file in the Import Endpoint component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A flaw has been found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/auth/setup file in the Schedule API component. The manipulation causes command injection, and the attack can be initiated remotely. The exploit has been published and may be used.

Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back, allowing a user to obtain a validly signed token containing any claims they choose, accepted as a session, an organization invitation with a chosen role, a password reset or an enterprise provisioning token.

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.

The Relevanssi plugin for WordPress (versions up to 4.28.4) contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 4.28.4.

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call with no cap and ignores the return value, so the declared Content-Length determines the allocation.

The WpEvently plugin (versions up to 5.7.8) by Magepeople inc. contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

The UPI QR Code Payment Gateway for WooCommerce plugin (versions up to 1.6.3) has a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

In Postiz, a media path that is not a web address is treated as a file on the server's disk without verifying it lies inside the upload directory. A registered user can store a crafted media path with a post and cause the publishing worker to read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads are reachable through two further routes, including file existence checks and backend memory exhaustion; self-registration is open by default.

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.