CVE Vulnerability Catalog

A vulnerability was determined in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the createdBy argument causes dynamically-determined object attributes. The attack can be performed remotely. The exploit is public, and the vendor did not respond.

A vulnerability was found in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the labels argument results in denial of service. The attack can be executed remotely. The exploit is public, and the vendor did not respond.

A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3 in the Legacy File Manager component, specifically in the file htdocs/core/filemanagerdol/connectors/php/config.inc.php. Manipulation leads to improper access controls. The attack can be launched remotely. The exploit is public. Upgrading to version 23.0.4 resolves the issue.

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.

A flaw has been found in itsourcecode Sales and Inventory System 1.0 in the file /pages/inv_del.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely. The exploit is public.

A vulnerability was detected in light0011 cms (specific versions) in the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the Chapter Content Output component. Manipulation of the content argument results in cross-site scripting. Remote exploitation is possible. The exploit is public, and the project has not responded.

A security vulnerability has been detected in light0011 cms (specific versions) in the file App/Home/Controller/ChapterController.class.php of the Chapter Controller component. Manipulation of the content argument leads to authorization bypass. The attack may be launched remotely. The exploit is public, and the project has not responded.

Vulnerability in Samsung Opensource rLottie (version 25648aef19187b3f87f4d9420b8d761453ad4630) causes an out-of-bounds read, potentially leading to buffer overread.

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the stack and potentially enabling code execution.

MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface.

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue.

A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices, allowing an attacker who obtains the key and captures an HTTP Web UI login session to decrypt the administrator password.

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

node-csv is a full-featured CSV parser that prior to 7.0.2, when the columns and group_columns_by_name options are enabled, treats a duplicate __proto__ header as an existing property, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can inject inherited array values into the returned record, hide those values from JSON serialization, and affect property enumeration and type or shape checks.

Colord is a color manipulation tool that prior to 2.9.4 uses an ambiguous numeric regular expression in synchronous CSS color string matchers, allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast() can block the processing thread with a multi-kilobyte payload.

In the jwcrypto library, used for implementing JOSE standards, there is a flaw where during verification of a General JSON Serialization JWS with a set of keys, the library fails to correctly identify the specific key ID (kid) and may accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.