CVE Vulnerability Catalog

An unauthenticated arbitrary file upload vulnerability in Yonyou KSOA 9.0 allows remote code execution via a crafted POST request to the ImageUpload servlet. Attackers can upload a JSP webshell without any authentication or validation.

Dockwatch through version 0.6.567 contains an unauthenticated OS command injection vulnerability. A missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php allows remote attackers to execute arbitrary shell commands.

A relative path traversal vulnerability in the "keyhint" option of repomd.xml parsing in libzypp before 17.38.12 allows attackers to supply a malicious repository to inject or overwrite files on the target system as root.

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability allows an authenticated low-privileged attacker to send specially crafted requests, potentially leading to unauthorized access and modification of application data.

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, an authenticated low-privileged user can craft a request during PDF generation, leading to operations performed with another user's privileges. This may result in unauthorized access to sensitive data and unintended system configuration changes.

An Incorrect Authorization vulnerability in UniFi Network Application allows a malicious actor with network access to persist privileges after such access has been removed, under certain conditions.

An authenticated SQL Injection vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.

A shellcode injection vulnerability in the Mercurial handler of the obs tar_scm source service before version 0.12.4 allows attackers with a malicious _service file to execute code as the source service or the local user.

An Improper Access Control vulnerability in UniFi Talk Application allows privilege escalation. An attacker with network access and low privileges can exploit this flaw.

A vulnerability in UniFi Network Application allows privilege escalation by an attacker with network access and low privileges, under certain conditions. The issue stems from improper access control.

A Path Traversal vulnerability in UniFi Access Application allows a malicious actor with network access to read files on the host device.

A vulnerability in UniFi OS allows unauthorized changes to devices by an attacker with network access under certain network configurations.

An SSRF vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.

A vulnerability in UniFi Network Application allows an attacker with network access and low privileges to escalate privileges through improper access control.

An SSRF vulnerability in UniFi Talk Application allows an attacker with network access to perform a DoS attack and bypass authentication on certain API endpoints.

A vulnerability in UniFi OS with UniFi Protect Application allows privilege escalation on the host device. The flaw is due to improper access control, which can be exploited by a malicious actor with network access and low privileges under certain conditions.

A Path Traversal vulnerability in UniFi Protect Floodlight devices allows an attacker with network access to read files on the device.

A vulnerability in UniFi OS is caused by a misconfigured CORS policy, allowing an attacker to lure an authenticated user to a malicious page and trigger actions in the system using that user's session.

A vulnerability in the UniFi Protect Application allows an attacker with network access, under certain conditions, to bypass authentication in UniFi Protect Cameras due to improper initialization.

A vulnerability in UniFi Protect Application allows an attacker with network access to bypass authentication for data streaming due to improper access control.