CVE Vulnerability Catalog

A vulnerability allowing remote unauthenticated code execution on the agent host.

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information.

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information.

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent and obtain that agent's credentials.

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remote code execution.

Multiple H3C router models contain command injection vulnerabilities in the /api/esps request handler. Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device.

Flowise before version 3.1.3 has a vulnerability in executeJavaScriptCode() that accepts caller-provided nodeVMOptions and merges them over the default NodeVM security settings. An authenticated attacker can run a custom function that imports utils.js, calls executeJavaScriptCode() with options allowing all built-in modules, and then uses child_process to execute arbitrary system commands as root on the Flowise server.

Flowise before version 3.1.3 has a code injection vulnerability in the AgentAsTool, ChatflowTool, and ExecuteFlow components that run code in the vm2 sandbox. The user-controlled baseURL value is inserted directly into JavaScript code, and the only validation is isValidURL, which does not prevent breaking out of the string. An authenticated user can inject their own JavaScript code, which can escape the sandbox and execute arbitrary code on the Flowise server.

OpenCode Studio before version 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can also delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint.

Kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation. OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.

Flowise prior to 3.1.3 allows authenticated users to set arbitrary TypeORM DataSource options through the additionalConfig input in several record manager and agent memory nodes. Options such as entities, subscribers, and migrations can load local JavaScript files, allowing an authenticated user to execute arbitrary code on the server by uploading a JavaScript payload and referencing it from additionalConfig.entities. This issue is fixed in version 3.1.3.

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device.

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode passwords as bytes, silently replacing characters outside that charset with '?'.

In HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc., there is a vulnerability involving cleartext storage of sensitive information that allows SQL Injection. The issue affects versions from 26.0 before 26.1.

HUMANIST Digital Human Resources by Bilin Software contains a hard-coded cryptographic key vulnerability, allowing read of sensitive constants within an executable.

Unrestricted upload of dangerous file types in HUMANIST Digital Human Resources allows uploading a web shell to the server. Affects versions from 26.0 before 26.1.

The product firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this key allows attackers to breach HTTPS confidentiality and integrity, enabling traffic decryption and server spoofing.