CVE Vulnerability Catalog

Part-DB, an open source inventory management system for electronic components, prior to version 2.12.1 contains a stored XSS vulnerability. The LogEntryExtraFormatter class in the CollectionElementDeleted branch interpolates getOldName() and getCollectionName() into HTML without htmlspecialchars(), allowing a low-privileged content editor to store an HTML/script payload as the name of a sub-element and have it executed in the browser of a higher-privileged victim viewing the activity log or element history.

OpenStack Ironic through version 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, also known as a gzip bomb.

An input validation issue in the Okta Access Gateway (OAG) Admin Console allows processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in onPhase Forms version 11.0.14 allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

An authentication bypass vulnerability in the public onPhase/frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters.

In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly validate the url_route argument, leading to an open redirect.

In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly handle the content argument, leading to cross-site scripting (XSS).

In gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8, the function sistem.php::simpan in application/modules/admin/controllers/sistem.php (Settings Handler component) is vulnerable to cross-site scripting via manipulation of the Title argument. The attack can be carried out remotely, and the exploit is publicly available and may be used. The project uses a rolling release strategy, so version details cannot be specified.

In the iscsiuio component of open-iscsi, the IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

In the iscsiuio component of open-iscsi, the DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

In the iscsiuio component of open-iscsi, the DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

A cross-site scripting (XSS) vulnerability was found in the gedelumbung HospitalManagement application, specifically in the kirim function of application/modules/web/controllers/contact.php within the Contact Form component. Manipulating the nama, email, alamat, telepon, or pesan arguments can lead to script execution. The attack can be performed remotely, and a public exploit has been disclosed.

The authentication framework used by Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

The ONVIF device service on Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow-on attacks such as traffic interception or certificate validation bypass.

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.

The network management service on Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command. An authenticated web user with network configuration permissions can exploit this to execute arbitrary operating system commands as root.

The system control service on Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.