CVE Vulnerability Catalog

Vulnerability in Oracle Enterprise Manager Base Platform (component: Event Management) affecting versions 13.5 and 24.1. A low privileged attacker with network access via SOAP can easily exploit it, resulting in unauthorized creation, deletion or modification of critical data.

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component. The vulnerability can be exploited to inject malicious script.

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection.

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action. An authenticated user with Edit Page Multilingual Settings permission on a single page could bind an arbitrary page in another locale as that source page's translation and delete legitimate translation pairs, altering public-facing language routing.

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery. The vulnerability can be exploited for privilege escalation and lateral movement.

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters. The vulnerability compromises the confidentiality of stored credentials.

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Joomla Extension J2Store in versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 reflects unescaped request data into the PayPal notify redirect. A crafted link to the paypal notify endpoint, if followed by a victim's browser, causes the redirect to com_j2store's checkout controller to carry attacker-chosen query parameters.

Joomla Extension J2Store in versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 uses a predictable/forgeable order access token. Anyone who obtains the site's Joomla secret can compute a valid access token for any order without placing one, gaining guest access to order details and digital downloads.

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The activate_files() action created PageTemplate records from attacker-supplied values without validating an anti-CSRF token. A remote attacker could host a page that auto-submitted a forged POST request; when a signed-in administrator visited it, the request executed under the administrator's session, changing site configuration without consent.

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could continue to mint valid access tokens after being deactivated or suspended (uIsActive=0), so deactivating an account did not revoke its API access.

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the administrator-configured reserved-word list without validating the anti-CSRF token or restricting the request to POST. A remote attacker could lure an authenticated user with SEO access to a crafted page, reverting the reserved-word list to default and silently altering future URL-slug generation.

Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). The action enforced page-edit authorization but performed no token check, and its route accepted any HTTP method. An attacker could induce a signed-in content editor into loading an attacker-controlled page that auto-submitted a cross-site request and reordered or moved blocks in the draft version of a page.

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

On Arista EOS platforms, under certain circumstances, plaintext shared secrets for configured TACACS+ servers may be exposed. The issue affects systems running Arista EOS.

On Arista EOS platforms, under certain circumstances, user passwords may be written in cleartext to log files when specialized non-standard debugging trace levels are explicitly enabled. Exploitation requires authenticated local administrative access to the device shell.

On Arista EOS platforms, under certain circumstances, plaintext private keys may be written in cleartext to log files when specialized non-standard debugging trace levels are explicitly enabled. Exploitation requires authenticated local administrative access to the device shell.

On Arista EOS platforms with dual switch cards and ingress Security ACLs configured on shared-mode Switched Virtual Interfaces (SVI), restarting the secondary switchcard forwarding agent or inserting the secondary switchcard can cause Security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior.

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember's chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the required CRLF. When an intermediary forwards chunked data without re-encoding and interprets malformed chunk boundaries differently, an unauthenticated attacker can create TE.TE request smuggling that bypasses intermediary controls, poisons caches, or hijacks the request queue.