CVE Vulnerability Catalog

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1 affecting an unknown part of the Dnsmasq component. Data manipulation results in CRLF injection, and remote exploitation is possible. The exploit has been made public, and the vendor did not respond to the disclosure.

SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.

SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer, allowing controlled data to be written beyond buffer boundaries and potentially enabling code execution.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1 in the plugin_init function of /tmp/upload_files within the PPPoE WAN Setting Handler component. Manipulating the pppd_options argument leads to unrestricted upload. The attack can be launched remotely and the exploit has been publicly disclosed.

The FunnelKit Automations plugin (wp-marketing-automations) by Aman contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects FunnelKit Automations from n/a through 3.8.5.2.

The Ash library (ash-project) contains an Authorization Bypass Through User-Controlled Key vulnerability. Under attribute multitenancy, create actions with upsert? true could update another tenant's records and return their attributes, and default upsert fields moved the record into the caller's tenant. The issue affects versions from 1.22.0 before 3.37.2.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

A flaw was found in halo-dev halo up to version 2.27.0-beta.1 in the resolveViewNameOrDefault function of the DefaultViewNameResolver class, which handles view name resolution. Manipulating the template argument leads to path traversal, allowing access to files outside the intended directory. The vulnerability can be exploited remotely and a public exploit is already available.

The Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the application's installation folder may be tampered with, resulting in arbitrary code execution.

A vulnerability was detected in the Yoosee GM8135S Camera version 21.00.01.36 within the Secure Boot component. Improper verification of cryptographic signatures allows bypassing secure boot. The attack requires local access, and a public exploit is available.

A vulnerability was identified in HashenUdara edoc-doctor-appointment-system in the file admin/add-new.php, where manipulation of the 'spec' argument leads to SQL injection. The attack can be performed remotely, and a publicly available exploit may be used. The product uses a rolling release model, so no version details are available.

A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows in the SignalR Hub component, file /LiveWallpaper/UploadFile, resulting in missing authentication. The attack can be carried out remotely, and the exploit has been made public. A patch named b62f878899adbfc2968e3345442f3a3df91b774d is available.