Omnispace Agora Project versions through 26.10.0 have a vulnerability in token generation where the md5Id token can be predicted due to a missing dateCrea value. This allows unauthenticated attackers to compute valid tokens and access private calendar events by exploiting the misc&action=DisplayIcal endpoint without authentication.
Omnispace Agora Project versions through 26.10.0 have an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can exploit this flaw by manipulating the reloadMailTypeId parameter in the CtrlMail.php component to access private mail messages of other users without proper ownership checks. This leads to unauthorized disclosure of sensitive communication content.
An integer overflow vulnerability exists in picoquic versions before 2026.11.05.3e2e3d3 in the picoquic_decode_time_stamp_frame() function. This flaw allows remote QUIC peers negotiating the TIME_STAMP extension to send oversized TIME_STAMP values that cause integer overflow, corrupting stored timestamps. The corruption affects round-trip time (RTT) and bandwidth estimation, leading to degraded congestion control performance.
MRBS versions prior to 1.13.0 have a password reset poisoning vulnerability that allows unauthenticated attackers to forge the Host header when the $url_base configuration is unset. This enables attackers to cause password reset emails to contain links pointing to attacker-controlled hosts, potentially capturing reset keys and taking over user accounts, including administrators.
Omnispace Agora Project versions through 26.10.0 have a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to perform privileged actions, such as creating administrator users, by exploiting the merging of $_GET and $_POST parameters without requiring an anti-CSRF token. The vulnerability leverages the absence of CSRF protection combined with SameSite=Lax cookie behavior on top-level navigations, enabling attackers to craft malicious links or auto-navigating pages that issue GET requests to execute unauthorized actions.
Omnispace Agora Project versions through 26.10.0 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious HTML markup via imported directory data or uploaded CSV files. The vulnerability arises because input values are only UTF-8 encoded without proper HTML escaping, enabling crafted CSV cells to execute arbitrary scripts in the administrator's browser during import.
Gameyfin versions before 2.6.2 have a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by accessing certain endpoints. Attackers can call Hilla endpoints annotated with @AnonymousAllowed, including synchronous endpoint methods like GameEndpoint.sync, which are not checked by LiveSubscriptionSecurity. This enables retrieval of game catalog metadata, libraries, platforms, plugins, and game requests without authentication.
MRBS versions prior to 1.13.0 have an LDAP injection vulnerability in the AuthLdap.php component. This flaw allows attackers with valid directory credentials but outside the required group to bypass access restrictions by submitting specially crafted usernames that manipulate LDAP filters.
SQLBot versions through 1.10.3 use unsalted MD5 hashing for storing local account passwords in the sys_user.password field. This weak hashing method allows attackers who access the user table to recover passwords, including administrator credentials, via precomputed hash tables or GPU-accelerated cracking. The vulnerability arises from the use of md5pwd() in security.py, which does not apply salting to the hashes.
Goose CLI versions from 1.35.0 up to but not including 1.53.0 contain a local code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating the diff.external setting in a repository's .git/config file. When a victim runs the 'goose review' command on a crafted repository, it triggers git diff without the --no-ext-diff option, enabling command execution as the user and potentially exposing sensitive credentials and API keys.
C-Kermit versions prior to 11.1.515 have an OS command injection vulnerability that allows remote clients to execute arbitrary shell commands. This occurs when unquoted arguments are supplied to the REMOTE WHO or REMOTE SPACE commands, enabling attackers to append shell metacharacters to arguments passed to syscmd(). This vulnerability can be exploited even if the DISABLE HOST setting is enabled.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a remote code execution vulnerability. This flaw allows attackers to execute shell commands on servers even when host commands are disabled by exploiting REMOTE QUERY evaluation. Attackers can invoke the command function or define and execute macros to bypass restrictions, leading to full compromise. The vulnerability has a high severity score of 8.1 CVSS v3.1.
A local file disclosure vulnerability exists in agent-device versions from 0.21.36 up to but not including 0.21.37. Authenticated remote users can exploit this flaw by sending commands that open file:// URLs via the /rpc interface, allowing them to read any plaintext file accessible by the daemon account.
A critical OS command injection vulnerability exists in the TFTP provisioning module of Zenitel EdgeAudioClient versions before 9.6.3.0 and 10.x before 10.1.3.0. This flaw allows unauthenticated adjacent attackers to execute arbitrary commands as root by supplying a crafted DHCP option 66 value via a rogue DHCP server on the same network segment. The vulnerability affects devices using DHCP on every boot and lease renewal. Additionally, the injection can be triggered through certain configuration fields if an attacker can modify the device configuration.
C-Kermit versions prior to 11.1.515 contain a heap buffer overflow vulnerability in the putsrv() function within ckcfns.c. This flaw allows malicious peers to write beyond the srvcmd buffer by sending specially crafted packets using Kermit repeat-count compression in server command, GET, or file-header packets. The vulnerability can lead to arbitrary code execution or denial of service on affected servers or receiving instances.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a vulnerability in certificate validation. The function ssl_reply() fails to call ssl_check_server_name(), allowing attackers to impersonate Telnet servers. This flaw enables machine-in-the-middle attackers to refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.
C-Kermit versions prior to 11.1.515 contain a vulnerability that allows malicious Kermit servers to bypass the RECEIVE CONFIRM prompt. This flaw enables attackers to write files without user consent by exploiting recursive GET root computation, potentially placing files like .ssh/authorized_keys or shell startup scripts in the current directory. Such unauthorized file writes can lead to persistent access or code execution.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 have a vulnerability in certificate hostname validation. This flaw allows attackers with a trusted certificate containing wildcard characters to impersonate hosts by exploiting improper matching in the DNS name comparison function. Successful exploitation can lead to interception of credentials and data over Telnet, FTP, and HTTP TLS connections.
C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw causes the Telnet authentication state to remain at AUTH_VALID after a refused certificate login. An attacker possessing a trusted certificate mapped to a refused account can exploit this to log in as any other account with any password, gaining shell access to that account.
Eclipse BaSyx Go Components versions up to and including 1.1.3 have an access control bypass vulnerability in ABAC-enabled deployments. The issue arises because access rules match the fully decoded request path, while routing uses the raw encoded path. This discrepancy allows an authenticated user with limited read permissions on parts of a resource to access the entire resource if the resource identifier contains encoded slashes. The vulnerability is fixed in version 1.1.4.