CVE Vulnerability Catalog

The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow installation of unsigned ACAP applications and if an attacker convinces the victim to install a malicious ACAP application.

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user to initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance and potential data exfiltration.

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

A vulnerability in the Zephyr USB CDC NCM driver causes a buffer overflow when handling GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE requests. A host can send a request with a wLength smaller than the response structure size, leading to an out-of-bounds write of up to 27 bytes.

The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download(). An attacker controlling the USB host can cause a device crash (denial of service) by sending a zero-length DFU_DNLOAD request.

The Realtek BEE Bluetooth HCI driver violates the net_buf ownership contract, leading to a double-free (CWE-415) and use-after-free read (CWE-416). The bug occurs in error paths when buffer allocation or controller send fails. A remote attacker can trigger these conditions via heavy Bluetooth traffic, potentially crashing the device.

The Kirki plugin for WordPress (up to version 6.2.0) is vulnerable to Stored Cross-Site Scripting via the post_meta shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts.

The Bluetooth HCI driver for Bouffalo Lab controllers (BL60x/BL70x/BL61x) violates the buffer-ownership contract in bt_bflb_send(). On error, it frees the buffer even though the caller still owns it, leading to a double-unref and memory corruption.

A flaw in wildfly-core allows a remote attacker authenticated as a 'deployer' account to import and deploy a malicious archive from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive.

A flaw in wildfly-core allows a remote user with administrative privileges to inject a malformed payload into the Inet Address field through the Management Model. This causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file.

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP. An authenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim clicks the link, the injected input is processed and reflected in the DOM on the client side, leading to execution of malicious content in the victim's browser.

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information.

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. An attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope.

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context.

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it.

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may lead to a high impact on confidentiality and low impact on integrity, with no impact on availability.

SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization checks on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality.

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session.

SQL Injection vulnerability in SAP Social Intelligence. An authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization.