CVE Vulnerability Catalog

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could exploit it to gain filesystem access.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could exploit it to bypass protection mechanisms.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could exploit it to gain filesystem access.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance's global configuration.

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

The product fails to sufficiently validate callback URLs, allowing manipulation with malicious payloads via weak regular expressions or omitted validation. An attacker can craft a legitimate-looking link that redirects users to an attacker-controlled page.

An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to authenticated remote code execution in the Log Forward option. An authenticated user can exploit this to execute arbitrary code on the server.

The Admin REST API accepts user-supplied input without adequate sanitization, allowing it to be included in the structure of SQL statements. A user with administrator privileges can influence the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact database service availability.

Fastify versions 5.8.0 through 5.12.7, when configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has sent headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on an already-started response, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process.

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request carrying the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed.

@fastify/http-proxy versions 11.6.0 through 11.6.2 normalize literal backslashes before percent-decoding the request path, so a path encoding backslashes and dot-segments survives the dot-segment check and only becomes backslash and double-dot sequences afterward. When the upstream treats backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling upstream location.

@fastify/http-proxy versions 9.0.0 through 11.6.5 substitute URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value encoding a path separator with a fragment or query delimiter decodes into real separators, injecting extra upstream path segments and stripping the mandatory suffix. An unauthenticated remote attacker can reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, SSRF or authorization bypass.

@fastify/secure-session versions 7.5.0 through 8.4.1, when configured with the signed cookie option, calls the cookie unsign routine but still passes the original cookie value to the session decoder when the signature check reports it invalid, so a session with an invalid signature is decrypted anyway. This matters when an application uses a signing secret separate from the encryption key and rotates only the signing secret to retire sessions while keeping the encryption key active.

@fastify/multipart versions 5.3.0 through 10.1.6 does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler doing asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds.