CVE Vulnerability Catalog

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM.

A security vulnerability has been detected in 0x4m4 HexStrike AI in the FileOperationsManager function of hexstrike_server.py (API Files Endpoint component). Manipulation of the filename argument leads to path traversal. The attack may be initiated remotely and the exploit has been publicly disclosed.

A weakness has been identified in 0x4m4 HexStrike AI in the subprocess.Popen function of hexstrike_server.py (API Tools Endpoint component). Manipulation of the additional_args/target/username/password/scan_type/payload arguments can lead to OS command injection. The attack can be launched remotely and the exploit has been made available to the public.

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC in the formDelWebAuthWhiteUser function. Manipulation of the webAuthWhiteUserIndex argument results in a stack-based buffer overflow. The attack can be initiated remotely.

Joomla Extension Modals Pro (regularlabs.com) versions < 17.0.0 contains a privileged stored XSS vulnerability via the event handler option. The extension supports JavaScript events such as on-open and on-closed but does not distinguish trusted configuration from event code supplied in article content. A lower-privileged author can use this feature to inject malicious code.

Joomla Extensions Snippets Free (< 7.0.0) and Snippets Pro (< 11.0.0) from regularlabs.com contain a privileged stored XSS vulnerability via the url option. Snippets substitutes variable values supplied by an article tag into saved Snippet content without considering the article author's trust level. A lower-privileged author can place an unsafe value into a security-sensitive position chosen by the trusted Snippet author.

Joomla Extension Articles Anywhere (regularlabs.com) versions < 20.0.0 contains a privileged stored XSS vulnerability via the link option. The extension accepts link options such as onclick and onmouseover, which in affected versions become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.

Joomla Extension Tabs & Accordions (regularlabs.com) versions < 3.1.0 contains a privileged stored XSS vulnerability via the rtla-alias option. The extension rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.

Joomla Extension Quick Index (regularlabs.com) versions < 5.0.5 contains a privileged stored XSS vulnerability via the class option. The extension inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.

The Modals extension for Joomla (regularlabs.com) below version 17.0.0 treats destinations using executable browser URL schemes as ordinary modal URLs. The value can reach both the generated link and the iframe-loading path, enabling privileged stored XSS without using the separate Pro JavaScript Events feature.

SolarView Compact contains an OS command injection vulnerability in Schedule Settings. An attacker who can log in to the product may execute arbitrary OS commands.

An unrestricted upload of a file with a dangerous type exists in the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. A remote authenticated attacker can upload a specially crafted file, potentially leading to arbitrary code execution on the product.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. An attacker who can log in to the product may execute arbitrary OS commands.

An improper neutralization of directives in dynamically evaluated code ('Eval Injection') exists in CONPROSYS HMI System (CHS). An attacker who can log in to the product may execute arbitrary code.

An unrestricted upload of a file with a dangerous type exists in CONPROSYS TM Series. A remote authenticated attacker can upload a specially crafted file, potentially leading to arbitrary command execution on the product.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS TM Series. An attacker who can log in to the product may execute arbitrary OS commands.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS PAC Series. An attacker who can log in to the product may execute arbitrary OS commands.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. An attacker who can log in to the product may execute arbitrary OS commands.

A buffer overflow vulnerability exists in Contec EC1000 series. A remote attacker can send a specially crafted request to the product's web service, potentially leading to arbitrary program execution.

A buffer overflow vulnerability exists in Contec RP-WAH-SR Series. A remote attacker can send a specially crafted request to the product's web service, potentially leading to arbitrary program execution.