Threat database

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.

Linux heeft kwetsbaarheden verholpen in de IPv4 TCP stack en het IPv4 networking subsystem van de Linux kernel.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.

A high-severity unauthenticated race condition vulnerability in WordPress's Core update process allows remote code execution. The flaw arises from predictable, web-accessible staging directories during updates, enabling attackers to exploit a narrow time window while WordPress unpacks updates. WordPress 7.1.4 and earlier branches have been patched to randomize staging directories and prevent unsafe configuration promotion. Exploitation attempts began shortly after patch release, but no successful compromises have been reported.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

The Orion library's BLAKE2b implementation has a flaw in the reset() function when used with a key of different length than the original initialization key. This causes the computed BLAKE2b tag to be incorrect, leading to verification failures during normal protocol operations. The issue is fixed in versions 0.17.16 and 0.18.1.

LLVM's compilation of the internal function conditional_sub_u32() in the Orion cryptographic library introduces timing-vulnerable conditional jumps on certain CPU targets lacking conditional move/select instructions. This affects ML-KEM and ML-DSA cryptographic operations, potentially leaking secret-dependent information. The issue impacts specific Linux targets including i586, s390x, and x86_64 architectures. The vulnerability could enable recovery of cryptographic keys depending on the compiler, CPU, and attacker proximity. Fixed versions 0.17.16 and 0.18.1 address this by rewriting conditional_sub_u32() to consider conditional move/jump availability.

The `nix-nar` crate's `Decoder::unpack` function improperly handles path containment when extracting archive entries, allowing a malicious NAR archive to write files outside the intended destination directory via path traversal. This occurs because symlink targets are not validated and the containment check only compares path strings without considering symlinks created earlier during unpacking. An attacker can craft an archive that creates symlinks pointing outside the destination and then writes files through these symlinks, potentially enabling code execution by placing files in attacker-controlled locations.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.

Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it.  This issue was fixed in metric 242 in version 10.02.002.

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 242 in version 10.02.002.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.  This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67