CVE Vulnerability Catalog

A security vulnerability has been detected in Toggl Track Extension version 4.11.16. It affects an unknown function in the postMessage Handler component, where manipulation leads to an origin validation error. The attack can be initiated remotely, and the exploit has been publicly disclosed.

MCPHub prior to version 0.12.13 has a vulnerability in the MCPB file upload handler. When extracting a ZIP file, the 'name' field in the manifest is directly concatenated into a file path without sanitization, allowing arbitrary file write via path traversal. The cleanupOldMcpbServer function also uses the unsanitized name, potentially allowing deletion of arbitrary directories. This issue has been patched in version 0.12.13.

Incorrect access control in the SystemSettings function of TOTOLINK T6 allows unauthenticated attackers to retrieve administrative import and export endpoint information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

An information disclosure vulnerability was found in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The issue is in the window.addEventListener function of the postMessage Handler component, where manipulating the vidiqEvent argument leads to information disclosure. The attack can be performed remotely and the exploit is public.

The Silicon Labs SiWx917 WiFi driver's siwx91x_send() function frees a network packet it does not own. In the Zephyr TX path, the net_pkt is owned by the L2/networking stack; the driver only borrows it. Before the fix, the driver called net_pkt_unref(pkt) on the caller-owned packet, prematurely returning it to the shared packet pool.

Kubio AI Website Builder before version 2.9.1 has an improper input validation vulnerability. This could allow an attacker to inject unexpected data, potentially leading to unintended consequences.

A cross-site scripting (XSS) vulnerability was found in Typora up to 1.13.8/1.14.6 in the Mermaid Rendering Engine. Manipulating the classDef/style argument leads to XSS. The attack can be launched remotely and the exploit is public. The vendor released a fix in version 1.14.8.

A null pointer dereference vulnerability was found in struct2json 1.0 in the S2J_STRUCT_GET_string_ELEMENT function during JSON deserialization. Manipulating the valuestring argument can cause a crash. The attack can be initiated remotely and the exploit is public. The vendor did not respond.

A server-side request forgery (SSRF) vulnerability was found in NASA earthdata-search 1.0.0 in the OpenSearchGranuleSearchLambda function. Manipulating the openSearchOsdd argument can allow sending requests to arbitrary resources. The attack can be launched remotely and the exploit is public. The vendor did not respond.

The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who obtains an exported configuration file could recover valid credentials and use them to access the device or similarly configured systems.

WAPT Server versions 2.6.1.17834 and earlier contain a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions, bypass host scope restrictions, and read information from other rows or tables.

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 allows unauthenticated attackers to alter roaming behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 allows unauthenticated attackers to alter wireless availability windows via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 allows unauthenticated attackers to degrade traffic handling via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to alter mesh configurations via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to alter Wi-Fi availability schedule by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to alter firewall policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Stored Cross-Site Scripting (XSS) vulnerability in TaskRunHandler.post() in web/handlers/task.py in QD. When a task is run via /task/<taskid>/run, task log content is rendered into the HTML response without HTML encoding, allowing a low-privileged attacker to inject malicious script.

An OS command injection vulnerability was found in Edimax BR-6214K 1.40 in the system function of www/ping.asp (asp_setPing Endpoint). Manipulating the pingstr argument allows remote command execution. The exploit is public and the vendor did not respond.