CYBR International Malware Information Sharing Platform (MISP)

A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formOneKeyAccessButton of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , ,

A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been classified as critical. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , ,

A vulnerability was found in TOTOLINK A702R 4.0.0-B20230721.1521. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formWlanMultipleAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , ,

A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , ,

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for safety. For precompiles to be callable by smart contracts they must be explicitly configured as CallableByContract. If this configuration is absent, then the precompile should be unreachable via smart contract accounts. In commits prior to 0822030, the underlying implementation of CallableByContract which returned the AddressType was incorrect. It considered the contract address running under CREATE or CREATE2 to be AddressType::EOA rather than correctly as AddressType::Contract. The issue only affects users who use custom precompile implementations that utilize AddressType::EOA and AddressType::Contract. It's not directly exploitable in any of the predefined precompiles in Frontier. This is fixed in version 0822030.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to production or staging databases, potentially leading to data exfiltration, modification, or deletion. This is fixed in version 1.0.1. Workarounds include: immediately rotating credentials for the exposed database user, using a secret manager (like Vault, Doppler, AWS Secrets Manager, etc.) instead of storing secrets directly in code, or auditing recent access logs for suspicious activity.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, meaning only the block producer can call it. To ensure correctness, the ProvideInherent trait should be implemented for each inherent, which includes the check_inherent call. This allows other nodes to verify if the input (in this case, the target value) is correct. However, prior to commit a754b3d, the check_inherent function has not been implemented for note_min_gas_price_target. This lets the block producer set the target value without verification. The target is then used to set the MinGasPrice, which has an upper and lower bound defined in the on_initialize hook. The block producer can set the target to the upper bound. Which also increases the upper and lower bounds for the next block. Over time, this could result in continuously raising the gas price, making contract execution too expensive and ineffective for users. An attacker could use this flaw to manipulate the gas price, potentially leading to significantly inflated transaction fees. Such manipulation could render contract execution prohibitively expensive for users, effectively resulting in a denial-of-service condition for the network. This is fixed in version a754b3d.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ristretto identity element, leading to potentially incorrect cryptographic results. This is fixed in commit 36f70d1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. To conduct the attack an attacker would need a validly signed document from the identity provider (IdP). This is fixed in version 5.1.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26088.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26091.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26093.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26095.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26087.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials for the ftpuser account provide FTP access to the controller, enabling a remote attacker to upload or retrieve arbitrary files from writable firmware directories and thereby expose sensitive information or compromise the controller.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: import tarfile def _block_patched(self, count):     if count < 0: # pragma: no cover         raise tarfile.InvalidHeaderError("invalid offset")     return _block_patched._orig_block(self, count) _block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , , , ,

Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy. This omission weakens browser-level defenses and exposes users to cross-site scripting (XSS), clickjacking, and referer leakage. Although some instances attempt to enforce CSP via HTML tags, this method is ineffective, as modern browsers rely on header-based enforcement to reliably block inline scripts and untrusted resources.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers.

• Vectorstring: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: HIGH
• Scope: UNCHANGED
• Confidentiality Impact: LOW
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: LOW
• Exploitability Score: 2.2
• Impact Score: 1.4
• References: , ,

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file type. The plugin fails to enforce proper checks on content type and file extension before reading a file. As a result, even sensitive files accessible only to the root user can be read through the application interface. There is currently no fix for this issue. ``` POST /runners/load-reader HTTP/1.1 Host: User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: Content-Type: application/json Authorization: Bearer Content-Length: 127 Origin: http://192.168.124.119:3000 Connection: keep-alive Cookie: Priority: u=0 Cache-Control: max-age=0 {"functionName":"reader@dbgate-plugin-csv","props":{"fileName":"/etc\/shadow","limitRows":100}} ``` The request payload:  Lines of the file being returned: 

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , , ,

The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , , ,

XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , , ,

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , , ,

A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: ,

Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: ,

Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: ,

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the application directory. Fixed in release 24H2, but present in all earlier versions of Windows 11 for ARM CPUs.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution.

• Vectorstring: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: HIGH
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 1.6
• Impact Score: 5.9
• References: ,

Tenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument `mac` leads to heap-based buffer overflow.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet. The manipulation of the argument `shareSpeed` leads to stack-based buffer overflow.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` and `timeType` leads to stack-based buffer overflow.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/fast_setting_wifi_set. The manipulation of the argument `timeZone` leads to stack-based buffer overflow.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: ,

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shell to a Web Server.This issue affects MagicINFO 9 Server: less than 21.1080.0

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

A vulnerability, which was classified as critical, has been found in Campcodes Courier Management System 1.0. This issue affects some unknown processing of the file /print_pdets.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability classified as critical was found in Campcodes Courier Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Leakage Detector. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionality of the component IP DNS Leakage Detector. The manipulation leads to cleartext transmission of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the component HSTS Handler. The manipulation leads to security check for standard. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

A vulnerability classified as critical has been found in Jingmen Zeyou Large File Upload Control up to 6.3. Affected is an unknown function of the file /index.jsp. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/candidates_add.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability was found in Campcodes Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /edit_parcel.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /edit_staff.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit_branch.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formdeleteUserName of the file /goform/deleteUserName. The manipulation of the argument old_account leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/changeimage.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.3
• Impact Score: 2.7
• References: ,

IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: HIGH
• Exploitability Score: 3.9
• Impact Score: 3.6
• References: ,

A vulnerability was found in D-Link DI-8400 16.07.26A1. It has been classified as problematic. This affects an unknown part of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument share_enable leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function getPages of the file /cms/collect/getPages. The manipulation of the argument targetUrl leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , ,

A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The patch is named 33d9bb464353015aaaba84e27638ac9a3912795d. It is recommended to upgrade the affected component.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , , ,

A vulnerability classified as problematic was found in jerryshensjf JPACookieShop ????JPA? up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

A vulnerability classified as critical has been found in Engeman Web up to 12.0.0.1. Affected is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,