CVE Vulnerability Catalog

A link following vulnerability in WatchGuard Fireware OS's firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges and to tamper with firewall IP set data by planting a crafted file system object and triggering a list update. Written content is partially constrained.

An out-of-bounds read vulnerability in FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

A vulnerability was found in node-tesseract up to version 0.2.7 in the process function of lib/tesseract.js (Command Builder component). Manipulating the image argument leads to OS command injection, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used; the project has not yet responded to the issue report.

An integer overflow exists in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83. A malicious remote host may cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.

A race condition exists in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1. A local authenticated attacker with low privileges can execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.

Improper access control exists in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management. A local authenticated user with low privileges can execute arbitrary commands as SYSTEM by placing a crafted installer options file that is processed during service activation.

A DLL loading vulnerability exists in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1. A local authenticated attacker with low privileges can execute arbitrary code with elevated privileges, though exploitation requires user interaction.

A NULL pointer dereference exists in the WatchGuard Fireware OS management interface. A remote, unauthenticated attacker with network access to the management interface can crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sessions and in-progress management operations and can prevent management of the device; traffic processing is not affected.

A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.

The 3D Viewer app for Nextcloud in versions 1.7.9 through 3.3.1 did not enforce authorization on its public file endpoint. Anyone knowing a share token could read the contents of a shared 3D file even when the link share was password-protected, because the controller did not extend PublicShareController and thus bypassed the password-checking middleware. The issue is fixed in 3.3.2.

A stack-based buffer overflow exists in the Fireware OS logging service. A network-adjacent attacker who can impersonate or intercept traffic to the configured log server can execute arbitrary code with root privileges by presenting a specially crafted certificate.

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.