Cudy TR3000 routers running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by importing a malicious OpenVPN client configuration containing specially crafted tls-verify or ipchange directives. These directives bypass an incomplete denylist and allow execution of root commands when the router connects to the attacker-controlled VPN endpoint. This vulnerability enables full control over the device with high impact on confidentiality, integrity, and availability.
Zenitel Connect versions before 1.11.0 have a vulnerability in the login flow where different error messages are returned depending on whether a submitted username exists. This behavior allows remote attackers to enumerate valid user accounts by sending crafted login requests.
A buffer overflow vulnerability exists in the handling of EDID Display-Range descriptors in X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26. This flaw could allow a malicious monitor to crash the X server or potentially execute code with limited privileges. The vulnerability has a high severity rating with a CVSS score of 7.8.
A Ruby object-document mapper fails to apply automatic field-level encryption to certain fields when using class inheritance in the data model. As a result, values intended for encryption are stored in readable form in the database without any error or warning. This allows a database account with read-only access to the application's collections, but no access to the encryption key store, to obtain sensitive plaintext data.
Zenitel Connect versions before 1.11.0 have a vulnerability in their web interface where an integration iframe is loaded without sandboxing or origin restrictions. This flaw allows remote attackers to present phishing content to authenticated users by crafting a malicious frame source. The vulnerability has a medium severity rating with a CVSS score of 5.1.
A vulnerability in the Mongoid ODM's automatic client-side encryption schema generation can cause values intended for encryption to be stored in cleartext when multiple models share the same storage location. This occurs without any error or warning, potentially exposing sensitive data to users with read-only database access but no encryption keys.
Zenitel Connect versions before 1.11.0 implement a per-account lockout mechanism on repeated failed login attempts. This behavior allows remote attackers to cause a denial of service by repeatedly submitting failed login requests for known or guessed usernames, temporarily locking targeted user accounts from accessing the web interface. The vulnerability does not affect intercom call handling functionality.
Zenitel Connect versions before 1.11.0 contain a vulnerability in the WAMP-CRA authentication path that allows unlimited authentication attempts without account lockout or rate limiting. This flaw enables remote attackers to guess user passwords via brute force. However, exploitation is limited by a strict password policy requiring at least 12 characters with mixed character types. The vulnerable authentication path is removed in version 1.11.0.
Huatian Dynamic OA8000 collaborative office system has an unauthenticated path traversal vulnerability in the /OAapp/jsp/trace/ntkodownload.jsp endpoint. The vulnerability arises because the filename parameter is not properly sanitized, allowing attackers to use ../ sequences to access arbitrary files on the server. This can expose sensitive files such as the Tomcat configuration (ROOT/WEB-INF/web.xml), potentially revealing configuration details and credentials. The vulnerability was first observed being exploited on 2024-11-20. The CVSS score is 7.5, indicating high severity.
@utcp/http versions before 1.1.14 have a server-side request forgery (SSRF) vulnerability that allows attackers to bypass remote-loopback checks using a {host} placeholder. This enables remote attackers to access internal loopback services such as 127.0.0.1 on the affected agent machine by supplying crafted host arguments or registering tools via Streamable HTTP and SSE discovery.
Dell PowerStore contains a SQL Injection vulnerability that can be exploited by an authenticated attacker. Successful exploitation may lead to disclosure of stored private keys and tampering with trusted certificates, posing significant security risks.
A vulnerability in open-telemetry's JavaScript client (opentelemetry-js) versions 0.204.0 through 0.221.x causes raw query strings from incoming HTTP requests to be recorded in tracing spans without redaction. This can expose sensitive information such as signed URLs or credentials to anyone with access to tracing backends. The issue is fixed in version 0.222.0.
Nuxt development server versions from 3.5.0 up to but not including 4.6.4 can serve files from a parent directory if that directory contains a stray lockfile or workspace settings file, even if the project is not inside a git repository. This allows an attacker who can access the dev server over the network to read arbitrary files under that parent directory, such as SSH keys or cloud credentials. The issue affects only the development server and not production builds. A fix is available in @nuxt/schema 4.6.4 and nuxt 4.6.4.
A concurrency issue in rails-html-sanitizer versions prior to 1.7.2 allows cross-site scripting (XSS) via shared scrubber state during concurrent sanitize calls with differing allowlists. The vulnerability arises because the PermitScrubber instance is shared and its tags and attributes are reassigned without synchronization, causing one request's sanitizer to use another's permissive allowlist. This affects multi-threaded Ruby on Rails applications using the default sanitizer configuration. The issue is fixed in version 1.7.2.
envd versions from 0.3.38 up to but not including 1.3.6 have a vulnerability in the install.python_packages(requirements=...) function that allows reading files outside the intended build context on the host. This occurs due to a time-of-check/time-of-use (TOCTOU) race condition between symlink resolution and file opening, which was partially fixed in v1.3.5 but fully resolved in v1.3.6. An attacker able to influence build inputs and concurrently modify filesystem paths may cause envd to disclose host files within the permissions of the envd process. The vulnerability may expose information through dependency debug logs and build-step metadata but does not allow arbitrary code execution or full file disclosure.
The node-global-key-listener-v9 npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_la_huitieme_vibration_by_carlo_lucarelli_fa21i' contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package 'dowload_ebok_can_i_let_you_go_part_3_of_3_by_cathy_glass_3ciom' contains malicious code that compromises any computer on which it is installed or run. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised device due to potential persistent malicious presence.