CVE Vulnerability Catalog

IBM WebSphere Application Server Liberty is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

IBM App Connect Enterprise has a vulnerability allowing a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

IBM App Connect Enterprise is vulnerable to a path traversal attack, allowing a remote attacker to read arbitrary files on the server.

IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user.

IBM Aspera Desktop App allows arbitrary code execution by loading DLL files at start-up.

IBM WebSphere Application Server Liberty is vulnerable to a denial of service (DoS) attack via a specially crafted request that causes excessive memory consumption.

Serendipity before version 2.6.1 has an authentication context confusion vulnerability where password validation and session loading operate independently. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. Long whitespace runs can cause significant parsing slowdown, leading to denial of service.

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. Non-ASCII digits in year, month, or day fields can lead to incorrect dates without parse errors.

Softtr Information Technology Trade Ltd. Co. E-Commerce Pack before version 5.03.01.49 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user.

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler. An attacker with database write access can store a crafted payload in the user_prefs column, which upon materialization of user preferences is passed to eval(), leading to automatic execution of arbitrary PHP code.

The SSH service on BSH ELP modules contains a vulnerability due to an insecure default configuration. A non-revocable SSH public key is included in the firmware's authorized_keys file for root. An attacker with the corresponding private key can bypass authentication and gain root-level access.

FTC E-Commerce Management Panel before version 1.0.2 contains a missing authentication for critical function vulnerability, allowing authentication bypass.

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header via the jsondir API endpoint, leading to arbitrary SQL execution and file writes using PostgreSQL functions, enabling remote code execution.

CentreStack before 17.2 contains an authentication bypass vulnerability. An unauthenticated attacker can read, write, or delete arbitrary account settings by exploiting exposed API endpoints lacking authorization checks. Attackers can forge valid encrypted EntAcctId values using a static shared encryption key, enabling enumeration of tenant domains and administrator identities.

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability. An unauthenticated attacker can supply a malicious URL to the SharePoint storage configuration handler, causing the server to fetch and parse attacker-controlled XML with external DTD references, leading to exfiltration of files such as Web.config containing database credentials and cryptographic keys.

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll. An unauthenticated attacker can supply a crafted base64-encoded XML string to exposed API endpoints, triggering creation of arbitrary local OS user accounts via the NetUserAdd Windows API.

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A user with VM deployment privileges can trigger an out-of-bounds read, potentially leading to information disclosure or a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact is restricted to information disclosure.

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this URL, allowing the attacker to obtain the token.

A flaw was found in koku-metrics-operator. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this URL, allowing the attacker to obtain the token.