CVE Vulnerability Catalog

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass via XML signature wrapping. The new_from_xml function reads assertion identity using document-wide XPath instead of the signed subtree, allowing an attacker to prepend an unsigned assertion and assume a user's identity.

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass by verifying responses against the response-embedded certificate when no trust anchor is configured. The verify_xml function accepts a response signed with an attacker's key, allowing authentication of an arbitrary assertion.

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used.

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used.

CTI-Transmute has a cross-site request forgery (CSRF) vulnerability in the user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET requests, allowing an unauthenticated attacker to trick an administrator into deleting an account without consent.

CTI-Transmute has an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The days parameter was not restricted to a reasonable range, allowing an attacker to overload the system.

CTI-Transmute is vulnerable to a server-side request forgery in the PDF report generation. User-controlled content can inject resource references (http, https, file) that the server fetches during rendering.

eParakstītājs 3.0 for Windows before version 1.10.0 fetches updates over an insecure channel. It accepts any TLS certificate and does not verify digital signatures or checksums.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In modem, there is a possible improper input validation, which could lead to remote denial of service without additional privileges.

In NR modem, there is a possible improper input validation, which could lead to remote denial of service, requiring system execution privileges.

Synology Assistant before version 7.0.7-50095 has incorrect default permissions. A local user can read or write arbitrary files and perform a denial-of-service attack during installation.

In the Wavlink WL-NU516U1 (version 708c073-mt7628), the config import function does not sanitize the Password argument, allowing remote OS command injection. The attack is complex but an exploit has been published.

The LogMyTrip WordPress plugin through 1.9 does not sanitize or escape a cookie value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on pages with the plugin's shortcodes.

The 'sm page duplicator' WordPress plugin through version 1.0.0 does not sanitize or escape a stored value before using it in a SQL statement when duplicating a page, allowing users with Editor role and above to perform SQL Injection attacks.