CVE Vulnerability Catalog

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability.

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. This issue is fixed in version 0.50.1.

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication.

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability.

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), so the authz middleware always allows requests. Any authenticated user (regardless of role or tenant) can invoke administrative APIs such as deleting users, resetting passwords, and creating tenants.

A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.

A SQL injection vulnerability in YzmCMS 7.5 occurs in the get_arrchildid() function in category.class.php. The parentid parameter is directly concatenated into a FIND_IN_SET() SQL clause without proper sanitization, allowing an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection.

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 lacks permission checks. Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful exploitation could result in disclosure of sensitive information and unauthorized access to device management functionality.

The Bendix EC80 brake ECU is vulnerable to a stack-based buffer overflow, potentially allowing an attacker to crash the ECU and remotely execute arbitrary code or inject CAN bus traffic. This could lead to loss of ABS, steering assist, speedometer, and shifting.

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network.

Ceph versions prior to 20.2.4 and 19.2.6, in the RGW SigV4 handler, do not reject requests carrying x-amz-* headers absent from the signed header set. This allows anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW honors, potentially leading to privilege escalation.

Wazuh versions 4.2.0 through 4.14.6 have multiple active response scripts that pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools running as root.

The ip-customblock active response script in Wazuh contains a path traversal vulnerability that allows an attacker to create or delete arbitrary files on the filesystem as root. The script does not validate the IP address in the srcip field, enabling the use of ../ sequences to escape the base directory.

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synergis Softwire installed on Windows servers.

Ceph versions prior to 20.2.4 and 19.2.6, in RADOS Gateway (RGW), protect STS session tokens with AES-128-CBC without message authentication, allowing an attacker holding a valid STS token to tamper with it undetected and escalate to full RGW administrative access.

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.