CVE Vulnerability Catalog

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Cloud Commander versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler calls the unguarded root() function instead of the root.resolve() validation wrapper. Attackers can use percent-encoded directory traversal sequences to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

SQL Injection (CWE-89) exists in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce. An unauthenticated remote attacker can read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.

The JetEngine plugin by Crocoblock up to version 3.8.16 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp). Attackers can leak heap memory by crafting a malicious archive where the superblock's no_ids field is set so that the final metadata block's expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Command Injection vulnerability due to improper neutralization of special elements used in a command. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.

Radar before version 1.12.2 contains a missing authorization vulnerability in the /api/local-terminal WebSocket endpoint that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's privileges, even when the --disable-local-terminal flag is set.

An OS Command Injection vulnerability (improper neutralization of special elements used in an OS command) exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. The vulnerability allows injection and execution of arbitrary operating system commands.

A missing authentication for critical function vulnerability exists in TR7 Cyber Defense Inc. TR7 ASP on both virtual and physical appliances. The lack of authentication enables OS command injection.

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

A deserialization of untrusted data vulnerability exists in the itthinx Affiliates plugin, allowing object injection. This can lead to unauthorized actions.

The JetProductTables plugin by Crocoblock up to version 1.2.4 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The WP OAuth Server plugin (miniOrange) in versions up to 6.4.0 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Paid Videochat Turnkey Site plugin by VideoWhisper.com up to version 7.5.12 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Bus Ticket Booking with Seat Reservation plugin (Magepeople inc.) in versions up to 5.9.7 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

An incorrect privilege assignment vulnerability exists in the M A Vinoth Kumar Frontend Dashboard plugin, allowing privilege escalation. This enables users to gain higher privileges than intended.