CVE Vulnerability Catalog

An OS Command Injection vulnerability in AccessManager of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to execute arbitrary commands as root in the YANG configuration. The flaw results from improper neutralization of special elements used in OS commands.

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions due to missing authorization. This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.

The Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint, bypassing CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

In YosemiteCrew, service and PMS task-library/template routes omit organization and permission checks. Any authenticated platform user, including a patient account, can modify or delete another organization's service catalogue and PMS template data, and service records can be read without authentication.

Shopper is a headless e-commerce admin panel. From 2.8.0 until 2.8.1, three Livewire admin components retain authorization gaps: a staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. They can grant arbitrary permissions including `access_setting` to their own role, create a pre-verified administrator with a chosen password, or delete roles, enabling privilege escalation and RBAC denial of service.

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS` (four), writing beyond `gem_id` into adjacent `gem_bonus_id` storage. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer. The advisory reports crashes and code execution demonstrated in a testing environment.

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 holding both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API does not enforce an administrator-only role. With storage replication enabled, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing command execution as root.

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in `USB Test/src/driveinfo.cpp` trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking success or enforcing size bounds. The value is used for division and to size a heap buffer before memcpy, so a malicious USB storage device can report a value below eight bytes causing repeated out-of-bounds writes, or zero causing a divide-by-zero denial of service.

GFI KerioConnect Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.