CVE Vulnerability Catalog

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF from 2.01.0.2183 before 18.9.26.2319.

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations. Authenticated users can relocate files from outside the document root, disclosing file contents and deleting originals.

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php. Authenticated users can inject OS commands through directory names and execute arbitrary commands as the web-server user.

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() function compares realpath() to boolean true, which never succeeds.

A path traversal vulnerability exists in GIS Informatics GisLab Laboratory Management System due to improper limitation of a pathname to a restricted directory. The issue affects versions from 1.4.03 before 1.5.

Some HikCentral Access Control versions contain an authorization flaw. An authenticated low-privilege user can invoke API interfaces that their role is not authorized to access.

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries.

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db endpoint misclassifies nested arrays when they contain an unrecognized stage key (e.g., $_internalInhibitOptimization), allowing a non-admin user to inject forbidden operators like $lookup and perform cross-collection joins into restricted collections.

Joomla Extension SP Property versions below 4.1.4 contain an unauthenticated stored cross-site scripting (XSS) vulnerability due to unescaped output in views and admin lists. Multiple template files rendered attributes and text values directly into HTML without contextual escaping.

Joomla Extension SP Property versions below 4.1.4 lack CSRF token verification in the property booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints. These endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.

GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, enabling remote exhaustion of memory, connection, and worker resources.

GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a WEP key containing shell syntax, allowing arbitrary commands to be executed as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a WPA-PSK containing shell syntax, allowing arbitrary commands to be executed as root when wireless configuration is applied.

In GeoVision GV-LPC2211 V1.13, an administrator can set a wireless SSID containing shell syntax, allowing arbitrary commands to be executed as root.