Base de CVEs

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.

As versões do Progress MarkLogic Server 12.x anteriores à 12.1.0 e as versões 11.x anteriores à 11.3.7 permitem que um atacante remoto com privilégios delegados de administrador de banco de dados execute operações de backup ou restauração em florestas fora do escopo autorizado do banco de dados, o que pode resultar em acesso não autorizado ou modificação de dados críticos para a segurança.

O Progress MarkLogic Server nas versões 12.x anteriores à 12.1.0 e nas versões 11.x anteriores à 11.3.7 permite que um atacante remoto com acesso de execução de consultas invoque uma função de avaliação de XQuery sem o privilégio adicional de avaliação exigido, o que pode resultar em execução de código no lado do servidor com permissões elevadas.

Versões 12.x do Progress MarkLogic Server anteriores a 12.1.0 e versões 11.x anteriores a 11.3.7 contêm uma falha de injeção XQuery em um caminho de pacote da Management API descontinuado. Um atacante remoto com privilégios de nível manage-user poderia explorar essa falha para obter controle administrativo persistente e não autorizado.

O Progress MarkLogic Server nas versões 12.x anteriores à 12.1.0 e nas versões 11.x anteriores à 11.3.7 contém uma falha de autorização em determinadas operações de gerenciamento de forests. Um atacante remoto com privilégios de gerenciamento de forests poderia explorar essa falha para criar uma conta de administrador persistente e não autorizada, o que pode resultar em controle administrativo completo e não autorizado do servidor.

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Foi identificada uma fraqueza no Linksys E1700 1.0.0.4.003. O elemento afetado é a função setDMZ do arquivo /goform/setDMZ. A manipulação do argumento MAC_addr pode levar a uma injeção de comando no sistema operacional. O ataque pode ser executado remotamente. O exploit foi disponibilizado ao público e pode ser usado em ataques. O fornecedor foi contatado antecipadamente sobre esta divulgação, mas não respondeu de nenhuma forma.

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy. This issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header which is exposed to the application as HTTP_REMOTE_USER. When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and does not perform an additional password verification. An attacker may therefore authenticate through the Generic Interface as an existing agent or customer user without knowing the corresponding credentials. The resulting privileges depend on the account being impersonated. Successful exploitation may allow access to confidential information and modification of data or configuration with the permissions of the affected user. Exploitation requires HTTP Basic Authentication to be configured as an authentication backend and a web server environment in which attacker-controlled HTTP headers are exposed through the corresponding HTTP_* environment variables. OTRS 7 and later are not affected by this attack vector due to the use of Mojolicious/Hypnotoad and does not expose arbitrary request headers through %ENV in the manner required for exploitation. The supported REMOTE_USER mechanism additionally requires validation through the configured SSO shared secret. The unused HTTP_REMOTE_USER fallback has nevertheless been removed as a security-hardening measure. Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Tokens de autenticação emitidos anteriormente não são invalidados imediatamente quando uma conta de agente ou de usuário cliente do OTRS é desativada ou quando sua senha é alterada. Como resultado, um JWT existente pode permanecer válido até seu tempo normal de expiração, que pode ser de aproximadamente 16 horas. Um atacante que tenha obtido anteriormente um token de autenticação válido pode, portanto, continuar a acessar o OTRS com os privilégios do agente ou usuário cliente afetado, mesmo depois que a conta correspondente tenha sido desativada ou a senha do usuário tenha sido alterada. A vulnerabilidade não permite, por si só, que um atacante obtenha tokens de autenticação. A exploração requer a posse de um token emitido anteriormente e ainda válido. O impacto real depende dos privilégios associados ao token comprometido. Tokens de usuários clientes são limitados às permissões da conta de cliente afetada, enquanto tokens de agentes podem dar acesso a funcionalidades mais amplas de tickets, clientes ou administrativas, dependendo das permissões atribuídas. Este problema afeta o OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X anteriores a 2026.7.X

Uma vulnerabilidade foi detectada nos TRENDnet TEW-751DR, TEW-752DRU e TEW733GR 1.03B01/1.03B03. A função afetada é fwrite, do arquivo pigwidgeon.cgi, do componente Web Management Backend. A manipulação do argumento service resulta em injeção de comandos de sistema. É possível lançar o ataque remotamente. O exploit agora é público e pode ser utilizado. O fornecedor confirma: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." Esta vulnerabilidade afeta apenas produtos que não são mais suportados pelo mantenedor.

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.