TÜBİTAK BİLGEM pardus-usb-formatter permission and access control issue vulnerability

Versions of TÜBİTAK BİLGEM Pardus-USB-Formatter prior to 0.7.0 and 0.7.2 contain a vulnerability related to permission escalation and access control. This issue arises because the program executes with unnecessary privileges, potentially leading to unauthorized privilege abuse...

FileOrbis cross-site scripting vulnerability

Versions of FileOrbis prior to 12.5.4 contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of script-related HTML tags on web pages, potentially enabling basic cross-site scripting attacks and allowing the use of malicious files...

CampCodes Complete Sales and Inventory System with Credit Management input validation error vulnerability

Version 1.0 of CampCodes Complete Sales and Inventory System with Credit Management contains a security vulnerability stemming from improper handling of the ‘branch’ parameter in the file /ahira/login.php; this may lead to SQL injection...

OWASP ModSecurity ModSecurity processing logic error vulnerability

OWASP ModSecurity versions from 3.0.0 up to and including 3.0.17 contain a logic error vulnerability. This vulnerability arises because its multipart parser fails to respect the priority of the filename parameter defined in RFC 2231. Attackers can exploit this by using the Content-Disposition...

Apache OFBiz input validation error vulnerability

In Apache OFBiz versions prior to 24.09.08, there is an input validation error vulnerability. This vulnerability stems from XML external entity injection in ContentWorker. Remote authenticated attackers possessing content author privileges can store specially crafted text/xml DataResources...

Geoffrey Merck DStarGateway digital error vulnerability

Versions of Geoffrey Merck DStarGateway prior to 7b75de6 and F4FXL DStarGateway prior to 7b75de6 contain a numerical error vulnerability. This vulnerability arises from an integer underflow occurring when the dstarCallsignToAPRS function in APRSUtils.cpp processes an empty RS-MS1A sender field...

MilaGraph RotatE path traversal vulnerability

MilaGraph RotatE has a path traversal vulnerability. This vulnerability stems from improper handling of the datapath parameter in the overrideconfig function within the Checkpoint Loading component’s codes/run.py file, potentially enabling path traversal attacks...

Apache OFBiz resource management error vulnerability

A security vulnerability exists in Apache OFBiz versions prior to 24.09.08; it stems from ServiceMultiEventHandler failing to limit resource consumption. UtilHttp.getMultiFormRowCount calculates the maximum number of rows based on the maximum value of “o” suffixes in multi-form submissions, and...

Apache OFBiz code injection vulnerability

Versions 24.09 prior to Apache OFBiz 24.09.08 contain a code injection vulnerability. This vulnerability stems from improper control over code generation; remote unauthenticated attackers can upload specially crafted widget XML via multipart form data. By sending anonymous JSON requests, they can...

Apache OFBiz authorization issue vulnerability

Versions of Apache OFBiz prior to 24.09.08 contain an authorization issue vulnerability. This vulnerability stems from a direct request forced browsing problem in the Content Manager component; specifically, the moveContentJson endpoint fails to perform permission checks. As a result, authenticat...

SAMSUNG Exynos 1480 digital error vulnerability

The SAMSUNG Exynos 1480 has a numerical error vulnerability stemming from insufficient boundary checks in the handling of NPU driver parameters, which may lead to integer overflow...

SuiteCRM code injection vulnerability

Versions prior to SuiteCRM 7.15.2 and versions 8.0.0 through 8.10.2 contain a code injection vulnerability. This vulnerability arises because Studio Dropdown Editor writes $dropdownname—processed via htmlentitydecode—directly into PHP files located in the custom/ directory. These files are then...

Kyverno resource management error vulnerability

Versions prior to Kyverno 1.19.2 contain a resource management error vulnerability. This vulnerability arises because namespace policy authors can submit pathological wildcard patterns to create policies with specially crafted match and exclude names, which are then evaluated via...

SuiteCRM authorization issue vulnerability

Versions prior to SuiteCRM 7.15.2 and versions 8.0.0 through 8.10.2 contain an authorization issue vulnerability. This vulnerability arises because the generatePdf entry point in the file modules/AOSPDFTemplates/generatePdf.php loads arbitrary records via BeanFactory::getBean, without checking...

Apache Juneau trust management issue vulnerability

Apache Juneau versions 9.2.0 and earlier contain a trust management issue vulnerability. This vulnerability arises because RestClient retains original request credential headers when following HTTP redirects, potentially leading to credential leakage...

Tiny Humans OpenHuman authorization issue vulnerability

Versions of Tiny Humans OpenHuman prior to 0.56.0 contain an authorization issue vulnerability. This vulnerability stems from a lack of equivalent transport or processor-level authentication in Socket.IO’s rpc:request and chat:start handlers. Unauthenticated local attackers can connect to the...

Apache OFBiz information disclosure vulnerability

Apache OFBiz versions 24.09.07 and earlier contain a security vulnerability stemming from the lack of authorization checks in the getHRChild service. Unauthenticated remote attackers can exploit this flaw by passing a specially crafted partyId parameter to recursively enumerate human resources...

Apache Juneau path traversal vulnerability

Apache Juneau versions 9.2.0 and earlier contain a path traversal vulnerability. This vulnerability arises because the microservice DirectoryResource fails to restrict request paths to the configuration root directory. When the application enables read, upload, or delete settings for resources,...

SignalWire FreeSWITCH digital error vulnerability

A security vulnerability exists in SignalWire FreeSWITCH versions prior to 1.11.2. This vulnerability stems from the switchxmlampencode function; it reserves only ten bytes for the maximum numeric character reference within a four-byte UTF-8 sequence, leaving no space for terminating NUL...

SHIRASAGI command injection vulnerability

Versions SHIRASAGI v1.19.0 through v1.21.0 contain a command injection vulnerability. This vulnerability stems from OS command injection and may allow authenticated attackers to execute arbitrary OS commands on systems running this product...

Kyverno resource management error vulnerability

Versions prior to Kyverno 1.19.2 contain a resource management error vulnerability. This vulnerability stems from a denial-of-service flaw in substituteVariablesIfAny; low-privilege users can use self-referencing variable templates to suspend admission webhooks. Attackers can create resources and...

Apache OFBiz authorization issue vulnerability

Versions of Apache OFBiz prior to 24.09.08 contain an authorization issue vulnerability. This vulnerability stems from a lack of checks for ACCOUNTINGUPDATE and ACCOUNTINGCREATE within accounting, allowing users with only ACCOUNTINGVIEW permissions to update or create PaymentApplications...

LeeJet Stable Diffusion.cpp input validation error vulnerability

A security vulnerability exists in leejet stable-diffusion.cpp. It stems from the IMatrixCollector::loadimatrix function in src/runtime/imatrix.cpp, which reuses the values and counts vectors for identically named tensor entries only when they are empty. Untrusted .imatrix files can provide...

Apache OFBiz authorization issue vulnerability

Versions of Apache OFBiz prior to 24.09.08 contain an authorization issue vulnerability. This vulnerability stems from authorization bypass in the Order Manager component; authenticated users can use the updateOrderPaymentPreference service to provide an orderPaymentPreferenceId belonging to a...

Amazon GluonTS path traversal vulnerability

Versions of Amazon GluonTS prior to 0.17.0 contain a path traversal vulnerability. This vulnerability stems from path traversal in the archive extraction tool. Attackers can exploit symbolic or hard links within specially crafted tar archives to write arbitrary files outside the intended extracti...

Tiny Humans OpenHuman authorization issue vulnerability

Versions of Tiny Humans OpenHuman prior to 0.57.13 contain a security vulnerability. This vulnerability allows attackers to send messages to configured external channels, causing the proxy to create persistent shell cron tasks without human approval. These tasks are then executed by the scheduler...

SAMSUNG Exynos 850 buffer error vulnerability

The SAMSUNG Exynos 850 has a buffer error vulnerability stemming from improper handling of NAS DLTransport messages, which may lead to baseband crashes...

Altium 365 input validation error vulnerability

The Altium 365 Git Service has a security vulnerability stemming from improper evaluation of required access levels during user pushes to the project repository. As a result, authenticated users possessing any access level to the target project can write to the project’s git repository, including...

Apache OFBiz server request forgery vulnerability

Versions of Apache OFBiz prior to 24.09.08 contain a server-side request forgery vulnerability. This vulnerability arises because the SurveyWrapper component fails to validate the protocol or hostname when setting the template location for product store surveys. As a result, authenticated backend...

SuiteCRM authorization issue vulnerability

A security vulnerability exists in SuiteCRM versions prior to 7.15.2 and from 8.0.0 up to 8.10.2. This vulnerability stems from a lack of module-level authorization in the V8 module API. It allows low-privilege users to create SchedulersJobs records with a controllable target value via...

Simple DirectMedia Layer SDL_mixer buffer error vulnerability

Versions 3.1.2 through 3.2.4 of the Simple DirectMedia Layer SDLmixer contain a buffer error vulnerability. This vulnerability arises when decoding A-law or mu-law WAV files; the FetchXLaw function in src/decoderwav.c experiences a stack buffer overflow. A specially crafted WAV file can overwrite...

Vulnerability related to the software supply chain issue in MyShell Ailice

MyShell Ailice versions 0.4.0 and earlier contain a vulnerability related to the software supply chain. This vulnerability arises because the LoadModelPEFT function within the file ailice/core/llm/AModelCausalLM.py in the HuggingFace Model Wrapper component processes the basemodelnameorpath...

Apache OFBiz authorization issue vulnerability

Apache OFBiz versions prior to 24.09 and up to 24.09.08 contain an authorization issue vulnerability. This vulnerability arises from user-controlled keys in the shopping list service, leading to authorization bypass. Authenticated users with low privileges can provide a third-party shopping list ...

SuiteCRM SQL injection vulnerability

SQL injection vulnerabilities exist in SuiteCRM versions prior to 7.15.2 and from 8.0.0 up to 8.10.2. These vulnerabilities arise because GetLatestRevision.php directly inserts getlatestforid into SQL UPDATE statements. An XSS payload bypasses quotation encoding, allowing literal quotes to be...

Red Hat build keycloak authorization issue vulnerability

Red Hat build keycloak contains an authorization issue vulnerability. This vulnerability arises because the idp-auto-link authenticator within the keycloak-services component automatically associates incoming identities with existing local accounts based on email addresses, without first verifyin...

Red Hat build keycloak authorization issue vulnerability

Red Hat build keycloak contains an authorization issue vulnerability stemming from problems in its protocol mapper and identity resolution components. The client manager uses a hard-coded declaration mapping to override the identity statement in tokens for service accounts without sessions. Since...

Keycloak resource management error vulnerability

Keycloak has a resource management error vulnerability. This vulnerability arises because the server fails to validate theme names before using them as keys for disk gzip caching. Unauthenticated attackers can exploit this by sending a large number of requests containing uniquely forged theme...

Apache OFBiz authorization issue vulnerability

Versions 24.09 prior to Apache OFBiz 24.09.08 contain a security vulnerability. This vulnerability arises because ViewDataFile.groovy dereferences the DEFINITIONLOCATION or DATAFILELOCATION request parameters in the viewdatafile interface as java.net.URL objects. No protocol whitelists, host...

Tiny Humans OpenHuman authorization issue vulnerability

Versions of Tiny Humans OpenHuman prior to 0.57.44 contain a security vulnerability. This vulnerability stems from the lack of client authentication and browser origin verification on the local /ws/dictation WebSocket endpoint. Unauthenticated clients can submit audio files, triggering...

Apache OFBiz input validation error vulnerability

Versions 24.09 prior to Apache OFBiz 24.09.08 contain a security vulnerability. This vulnerability stems from a lack of authorization in the XmlDsDump function; it allows unvalidated outpath and filename request parameters to write entity data before an ENTITYMAINT permission check. As a result,...

Apache OFBiz path traversal vulnerability

Apache OFBiz versions 24.09.07 and earlier contain a security vulnerability. This vulnerability stems from path traversal and lack of authorization checks in the imageCrop and imageRotate services. It may allow remote authenticated attackers with only Catalog viewing privileges to read any...

Trellix DLP on-prem extensions server request forgery vulnerability

Trellix DLP on-prem extensions versions 11.13.1 and earlier contain a server-side request forgery vulnerability. This vulnerability arises because the file Prefix parameter in the OpenEventEvidenceFile.do endpoint is not validated to accept arbitrary UNC paths. As a result, the server-side code...

SuiteCRM authorization issue vulnerability

Versions prior to SuiteCRM 7.15.2 and versions 8.0.0 through 8.10.2 contain an authorization issue vulnerability. This vulnerability arises because the V8 JSON:API update path fails to remove the id attribute before assigning user-provided attributes to SugarBean. It then enables attackers to...

Kyverno resource management error vulnerability

Versions prior to Kyverno 1.19.2 contain a resource management error vulnerability. This vulnerability arises because policy authors within namespaces can create a NamespacedValidatingPolicy or a NamespacedDeletingPolicy that includes nested mapping expressions. When CEL expressions are submitted...

SAMSUNG Exynos 2200 resource management error vulnerability

The SAMSUNG Exynos 2200 has a resource management error vulnerability. This vulnerability stems from a race condition in global variable access within the PPC, which may lead to out-of-bounds access...

Edimax BR-6208AC input validation error vulnerability

The Edimax BR-6208AC running version 1.32 contains a security vulnerability stemming from command injection in the /goform/mp functionality, which may lead to remote command execution...

Apache OFBiz cross-site scripting vulnerability

Versions of Apache OFBiz prior to 24.09.08 contain a cross-site scripting vulnerability. This vulnerability arises because the Catalog image viewer processes input during web page generation. Unauthenticated attackers can exploit this by using a specially crafted viewImage URL to execute arbitrar...

Blosc C-Blosc2 digital error vulnerability

Versions of Blosc prior to C-Blosc2 3.5.0 contain a numerical error vulnerability. This vulnerability arises because the blosc2schunkgetslicebuffer function in blosc/schunk.c fails to check for zero values in chunksize or blocksize; this results in a division-by-zero issue. Attackers can exploit...

SysAdmins Media HomeBox side-channel information disclosure vulnerability

Versions of SysAdmins Media HomeBox prior to 0.27.0 contain a side-channel information disclosure vulnerability. This vulnerability arises because the POST /api/v1/users/login endpoint performs password hash validation only when the submitted username matches an existing account; otherwise, it...

Eclipse BaSyx Go Helm Charts encryption issue vulnerability

The Eclipse BaSyx Go Helm Charts version 2.2.0 contain a security vulnerability. This vulnerability arises because deployments that enable bundled Keycloak store the plaintext client key for the basyx-technical-user OAuth2 client in a Kubernetes ConfigMap. Additionally, the template...