CVE Vulnerability Catalog

On Tenda BE3L Pro 16.03.60.62, the formWifiBasicSet function in /goform/WifiBasicSet mishandles the security_5g argument, causing a buffer overflow. The attack can be performed remotely and a public exploit is available.

A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.

MongoDB Compass improperly escapes certain BSON values when converting a stored view's aggregation pipeline into editable source. When a user connects to a deployment containing a specially crafted view and opens it for editing, the values can cause arbitrary code execution with the privileges of the user running Compass.

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file, or to the 'oratab' file itself, to execute code as root if an agent has the 'mk-oracle' plugin enabled.

Apache Traffic Server forwards malformed 302 responses that should be rejected as parse errors because the Transfer-Encoding: chunked carve-out bypasses the rejection path. A response that two peers can read differently is stored and served, allowing cache poisoning and response-framing desync.

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. Affects versions 8.0.1–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This affects versions 10.0.0 through 10.1.4 and 10.2.0.

The Tailored Tools plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability that allows forcing unintended actions on behalf of a logged-in user. This issue affects Tailored Tools versions up to and including 3.0.3.

In Vaadin Framework 8, VaadinService.requestEnd() locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request with a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and later requests to that session block forever, exhausting the thread pool and taking the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough.

Vaadin Charts renders charts with the Highcharts library and pins an exact version (9.2.2 in Vaadin 22-24 and 12.2.0 in Vaadin 25), so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, breadcrumbs.style, HTML text parsing while printing, and xlink:href attributes in exported charts. An application is affected where attacker-controlled data reaches the chart configuration, for example through additionalOptions, updateConfiguration(), or text options that accept markup.

The Apache Pulsar Packages Management Service with the FileSystemPackagesStorageProvider did not validate the version component of a package name, which could contain URL-encoded path separators and parent directory references. This allowed the filesystem storage provider to resolve the version to a location belonging to a package in a different tenant or namespace, and the containment check inside the storage directory did not prevent the access. An authenticated user with the packages permission on any namespace could download, overwrite or delete packages in other tenants or namespaces.

Apache Pulsar Manager contains multiple critical security flaws: unauthenticated creation of administrator accounts, lack of access control for proxied Pulsar admin API requests, and potential leakage of Pulsar authentication credentials. The project is no longer maintained and no fixes will be released.

Apache Pulsar contains two flaws in the authorization of requests forwarded by a proxy on behalf of another user. The first authorizes the original principal using the proxy's authentication data (affecting e.g. MultiRolesTokenAuthorizationProvider), and the second skips the original principal check for tenant admin operations when the proxy role is a tenant admin. This may allow users to perform operations beyond their own permissions.

Apache Pulsar did not apply subscription policies (Prefix subscription authentication mode or subscription permissions) in several admin REST API operations acting on subscriptions: clearing the backlog (for a named subscription and for all subscriptions), unsubscribe, and expiring messages for all subscriptions of a topic. An authenticated user with consume permission on the namespace or topic could bypass these policies and clear the backlog, expire messages, or delete a subscription that the policies would deny to that user.

A vulnerability in Apache Pulsar affects the shadow topics mechanism (PIP-180). The broker authorizes the caller only against the topic being created or updated, not against the source topic named in the PULSAR.SHADOW_SOURCE property. This allows an authenticated user with permission to create topics or update topic properties in one tenant to bind a topic to a source topic in another tenant and read its retained messages.

In Apache Pulsar, the functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors) returns the IO connector catalog without requiring super-user access, whereas the worker connectors endpoint enforces this check. As a result, any authenticated client can read the connector catalog metadata regardless of its role permissions. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.

The vulnerability affects the Apache Pulsar Functions Worker REST API trigger endpoint. The Worker publishes a message to the function's input topic using its own broker-client credentials rather than the caller's credentials, and does not verify that the caller is authorized to produce to that topic. Versions before 2.4.0 perform no caller authorization check for this endpoint at all.

Apache Pulsar broker versions 2.8.0 through 4.0.13 and 4.1.0 through 4.2.4 do not apply the tenant admin check to the caller for the truncate operation on a partitioned topic. Instead, the broker truncates each partition using its own internal admin client, so an authenticated user without tenant admin rights but with lookup permission can truncate any partitioned topic. This skips unacknowledged subscription backlog and permanently deletes older ledgers regardless of the namespace retention policy.

Apache Pulsar allows administrators to enforce end-to-end message encryption for all topics in a namespace via the encryption_required namespace policy. If loading a persistent topic fails during initialization (e.g., metadata store read error or topic-level policy load failure), the broker logs a warning, disables the encryption requirement for that topic, and completes the topic load as successful. As a result, an authenticated client with produce permissions can publish unencrypted messages that the broker accepts and stores, even though the namespace policy requires encryption.