CVE Vulnerability Catalog

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could exploit it to gain filesystem access.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could exploit it to bypass protection mechanisms.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could exploit it to gain filesystem access.

The product fails to sufficiently validate callback URLs, allowing manipulation with malicious payloads via weak regular expressions or omitted validation. An attacker can craft a legitimate-looking link that redirects users to an attacker-controlled page.

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.

Fastify versions 5.8.0 through 5.12.7, when configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has sent headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on an already-started response, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process.

@fastify/http-proxy versions 11.6.0 through 11.6.2 normalize literal backslashes before percent-decoding the request path, so a path encoding backslashes and dot-segments survives the dot-segment check and only becomes backslash and double-dot sequences afterward. When the upstream treats backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling upstream location.

@fastify/secure-session versions 7.5.0 through 8.4.1, when configured with the signed cookie option, calls the cookie unsign routine but still passes the original cookie value to the session decoder when the signature check reports it invalid, so a session with an invalid signature is decrypted anyway. This matters when an application uses a signing secret separate from the encryption key and rotates only the signing secret to retire sessions while keeping the encryption key active.

@fastify/multipart versions 5.3.0 through 10.1.6 does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler doing asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds.

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This can be exploited by uploading a crafted SVG file that is stored and rendered by the application. Consequences include redirecting the victim's browser to an arbitrary website, modifying the page UI, or retrieving browser information, though impact is mitigated as sensitive session cookies are protected with the httpOnly flag.

The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that redirects users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that redirects users to an attacker-controlled page.

When an Event Publisher output adapter is configured with properties irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.

SQL injection vulnerability classified as an internal threat level. Attackers can steal database information via SQL injection while logged in.

The affected component fails to enforce expected validation constraints on the 'content-type' header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated 'content-type' header.

The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state. This allows unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

Permission control vulnerability in the Bluetooth module. Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the autofill service module. Successful exploitation of this vulnerability may affect service confidentiality.