CVE Vulnerability Catalog

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides using case-insensitive path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name.

An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the installer's executable-resolution logic. This requires local access to the system.

In the Linux kernel, an AMD CPU erratum (#1718) was addressed where the processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. The kernel detects the erratum and applies a software workaround when no microcode fix is present.

In the Linux kernel, btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so the fix rejects it in the bounds check.

An XXE vulnerability in Apache Camel's Saxon component (XQueryBuilder) stems from the default Saxon Configuration not blocking DOCTYPE declarations or external entities. When a message body is already a javax.xml.transform.Source (e.g., after convertBodyTo(Source.class)), Saxon parses it without protection, allowing file reads and requests to named hosts.

boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privileges, allowing a local attacker to substitute malicious content or use the predictable filename for symlink attacks. This results in arbitrary sudoers rule injection and local privilege escalation to root. The issue was fixed in version 1.6.0.

The boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on GitHub, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access to the broker, allowing control of connected relays, blinds, and gates, and injection of fake entities into a linked Home Assistant installation. This issue was fixed in version 1.6.0.

boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits. This issue was fixed in version 1.6.0.

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.

Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contain an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archives and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.

A vulnerability was found in iFlytek astron-agent up to 1.1.2 affecting an unknown function in core/memory/database/api/v1/exec_ddl.py within the DDL Whitelist Handler component. The manipulation results in an incomplete blacklist and can be triggered remotely. The exploit has been publicly disclosed and the vendor did not respond.

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key that lets an attacker within Bluetooth range decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

An issue in the WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. The description does not provide further technical details.

Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothing bounds how much the connection process buffers; affects versions from 2.0.0-beta.1 before 4.9.0.

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a Plug reads the request body. Affects bandit from 1.4.0 before 1.14.0.

A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization, so a user or integration able to write such a value can store a script payload that executes in another user's browser session, including an administrator's, when the contact detail page is opened.

An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before use in database queries; an authenticated API user can use blind SQL injection to read arbitrary data from the Mautic database, including contact data and user account data with password hashes.

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before use in a database query; any authenticated Mautic user can exploit it regardless of role or permissions to read any data the Mautic database user can access, including user accounts with email addresses and password hashes, contact data, and campaign and email content.