CVE Vulnerability Catalog

A heap-based buffer overflow in the CNID daemon in Netatalk (versions 2.0.0-4.4.2) allows a remote authenticated attacker to execute arbitrary code with elevated privileges or cause a denial of service.

The Avada Builder (fusion-builder) plugin for WordPress up to version 3.15.2 is vulnerable to unauthenticated remote code execution via PHP function injection. The vulnerability allows attacker-controlled values from a base64-decoded JSON blob to be passed directly to call_user_func() without validation. Exploitation is possible through the fusion_get_widget_markup AJAX endpoint, which is accessible to unauthenticated users, and the nonce is deterministically exposed on public pages.

Altium 365 SearchService lacks authentication in a legacy SOAP endpoint, allowing an unauthenticated attacker to read the search index (component data, project names, user metadata) and inject, modify, or delete index entries. Affects Altium 365 cloud deployments.

Vulnerability in the Crypt::SaltedHash library for Perl (versions up to 0.09) uses the built-in rand function for salt generation. This function is predictable and unsuitable for cryptographic purposes, allowing an attacker to reproduce the salt.

A vulnerability in HP Linux Imaging and Printing Software allows privilege escalation and remote code execution via an integer overflow in the hpcups processing path when handling crafted print data.

The Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface. Unauthenticated attackers can access internal application pages such as index.zhtml, point.zhtml, and log.shtml without any session management or server-side authentication, enabling full administrative read and write access.

The Taiko AG1000-01A SMS Alert Gateway versions Rev 7.3 and Rev 8 contain hard-coded credentials in the web interface. Authentication is implemented entirely in client-side JavaScript, allowing credentials to be read from the page source.

Altium Enterprise Server Viewer has a path traversal vulnerability in the StorageController component. An authenticated user can read arbitrary files from the server filesystem, including the configuration file with database credentials and signing keys.

Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.

The Gift Cards For WooCommerce Pro plugin for WordPress (versions up to and including 4.2.6) contains an unrestricted upload of files with dangerous types vulnerability. This allows an attacker to upload malicious files to the server.

In Frappe Learning Management System (LMS) versions 2.50.0 and below, a user with course editing role can upload a SCORM ZIP package to write files outside the intended directory. Fixed in version 2.50.1.

A vulnerability in XWiki Platform versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17. The POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki.

A vulnerability in XWiki Platform allows reading configuration files by manipulating the resource parameter in ssx and jsx endpoints, leading to Path Traversal. Affects versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.

In Cisco Secure Workload, a vulnerability in the access validation of internal REST APIs could allow an unauthenticated, remote attacker to access site resources with Site Admin privileges. This is due to insufficient validation and authentication when accessing REST API endpoints. An attacker can send a crafted API request to a vulnerable endpoint to read sensitive information and make configuration changes across tenant boundaries.

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

The phoenix_storybook library from version 0.5.0 before 1.1.0 contains a code injection vulnerability allowing unauthenticated remote code execution. The vulnerability is in the psb-assign WebSocket event handler, where attribute names and values from unauthenticated clients are stored without sanitization and then interpolated into a HEEx template without proper escaping. This allows injection of an Elixir expression that is compiled and executed on the server.

NLnet Labs Unbound up to version 1.25.0 is vulnerable to cache poisoning via promiscuous records in the authority section. An attacker can inject non-NS records (e.g., MX) along with address records that Unbound caches, leading to cache poisoning. Version 1.25.1 includes a fix that disregards address records from the additional section if they are not explicitly relevant to NS records.

NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.