CVE Vulnerability Catalog

Nieprawidłowa kontrola dostępu w punkcie końcowym realtime.cgi urządzeń Deep Sea Electronics DSE855 w wersjach od 1.1.0 do 1.1.26 umożliwia atakującym uzyskanie dostępu do panelu administracyjnego oraz pełnej kontroli nad urządzeniem.

Missing Security Headers. This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Email Server Certificate Verification Disabled. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

BLU-IC2 and BLU-IC4 devices enforce an insufficient password policy. The issue affects versions through 1.19.5.

Kitware VTK through version 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.

W podatności CVE-2025-6520 w technologii Abis BAPSIS występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co pozwala na przeprowadzenie ataku typu Blind SQL Injection. Problem dotyczy wersji BAPSIS przed 202510271606.

Wtyczka King Addons for Elementor dla WordPressa jest podatna na eskalację uprawnień w wersjach od 24.12.92 do 51.1.14. Problem wynika z niewłaściwego ograniczenia ról, które użytkownicy mogą rejestrować.

Motyw Noo JobMonster dla WordPressa jest podatny na obejście uwierzytelnienia we wszystkich wersjach do i włącznie z 4.8.1. Problem wynika z funkcji check_login(), która nieprawidłowo weryfikuje tożsamość użytkownika przed jego uwierzytelnieniem.

A misconfiguration in UniFi Access exposed a management API without proper authentication. The vulnerability was introduced in version 3.3.22 and fixed in version 4.0.21 and later.

A vulnerability in the Mount service of Veeam Backup & Replication allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbitrary code execution in the context of the Log Server process.

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. The Logstash service has been altered to run as the lower-privileged 'nagios' user to reduce this risk.

Vulnerability in Nagios Log Server before version 2024R2.0.2 affects the cluster manager, which requests sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled. An attacker on the network path can intercept credentials in transit.

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.

Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.

Nagios XI versions prior to 2024R1.1.2 have a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization.

Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix socket RPC endpoints and perform privileged XML-RPC methods.

Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could manipulate SQL queries by supplying crafted input to specific CCM parameters, potentially allowing access to configuration data stored in the application database.

JumpServer versions prior to v3.10.20-lts and v4.10.11-lts allow an authenticated, non-privileged user to retrieve connection tokens belonging to other users via the super-connection API endpoint. The endpoint returns tokens created by all users instead of restricting results to the requester's tokens. This is fixed in v3.10.20-lts and v4.10.11-lts.