CVE Vulnerability Catalog

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations.

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() uses these attacker-controlled values as memcpy lengths, causing an out-of-bounds read of kernel memory that is disclosed in the ARP reply.

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected.

A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption. This may result in a denial of service (DoS).

A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console also probes common ports when the project server is down.

The Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression, and shell command substitution is then evaluated by a popen() pipeline as root.

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. The token browser does not sufficiently limit access to the types of tokens that are available, although the names of individual tokens are adequately protected.

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools such as browse_webpage, search_web, and torrent metadata parsers. The content is passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell, and attackers can bypass the validate_command_safety denylist and exploit the admin session's is_admin context.

A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.

A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.

A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.

IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware. This allows owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate.

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption.

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.

Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can force SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host.

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4, affecting the function whisper_model_load in src/whisper.cpp (Model Loader component). Manipulation of the ttype argument results in an out-of-bounds read; the attack requires local access and the exploit is now public.

SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow in the embedded HTTP server's Content-Type header parser. An unauthenticated remote attacker can send an oversized boundary value in a POST request, causing the device to become fully unresponsive and dropping management access and traffic forwarding.