Threats affecting pkg:generic/arrow

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.

The npm package @ewms/el-bootstrap contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.

A missing authorization vulnerability exists in CleverReach® WP plugin versions up to 1.5.26. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to partial confidentiality, integrity, and availability impacts.

Eclipse BaSyx Go Components versions up to and including 1.1.2 contain an authorization bypass vulnerability in ABAC-enabled deployments of the Submodel Repository and the AAS Environment. This flaw allows an authenticated user with read access to a single Submodel Element to retrieve all elements of that Submodel via the list route, exposing unauthorized data. The issue is resolved in version 1.1.3.

The CCC Attestation SIG attested-tls-poc project contains a time-of-check time-of-use (TOCTOU) vulnerability in its attestation process. The vulnerability arises because evidence is only appraised once during the TLS handshake, with no re-attestation after the handshake completes. This allows attackers with local access to the attesting endpoint to modify workload code, data, configuration, or attached devices such as GPUs, while peers continue to trust the original attestation evidence.

xschem versions 2.9.9 through 3.4.7 contain an out-of-bounds read vulnerability in the read_xschem_file() function within src/save.c. This flaw occurs when processing embedded-symbol records that lack a preceding instance, allowing crafted schematic files starting with a "[" record to cause memory reads below the instance array and crash the application.

An OS command injection vulnerability (CWE-78) exists in the network-configuration handling of the management service (uavmonitor_usbv1) on the 1300 communications board of DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an unauthenticated attacker on the local network to execute arbitrary commands as root by sending crafted configuration values to TCP port 16000. The injected commands persist across reboots. The affected products are no longer supported and no firmware fixes are available.

CVE-2026-128907 is a vulnerability in the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and affected 1300 communications board firmware versions. The service lacks authentication for critical functions, allowing unauthenticated local network attackers to read sensitive device information and change configuration settings via TCP port 16000 or the USB operator port. This vulnerability affects discontinued products with no available firmware fix.

xschem versions 2.9.9 through 3.4.7 contain a heap out-of-bounds write vulnerability in the read_dataset() function within src/rawtovcd.c. This flaw arises from an unchecked variable index, allowing attackers to craft malicious ngspice .raw files that cause heap memory corruption during conversion with rawtovcd.

Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability that allows a high-privileged attacker to access internal network services from the appliance. The vulnerability has a low severity with a CVSS score of 3.8. No specific affected versions or patches are currently identified.

A critical deserialization of untrusted data vulnerability (CWE-502) exists in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System versions up to 3.3.9. This flaw allows object injection, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data.

A stored cross-site scripting (XSS) vulnerability exists in Unbounce Landing Pages through version 1.1.6. This vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be executed in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.

A hard-coded credential vulnerability (CWE-798) exists in the DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and the 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an attacker with physical access to the board's serial console to log in as root using a password that is the same across all units. The password hash uses DES crypt and can be recovered offline from the firmware. No network login service accepts this password by default. The affected products are no longer supported by DJI, and no firmware fix is available.

Psono Server Community Edition versions 1.12.6 through 7.5.0 and Enterprise Edition before 7.5.1 have an authorization flaw in the DELETE /share/right/ endpoint. This flaw allows an authenticated user invited to a group with share-admin privileges to delete group share-rights without having accepted the group invitation. This can revoke access to shared secrets for all accepted group members without deleting the underlying data or exposing secret contents. The issue was fixed in version 7.5.1.

An improper verification of cryptographic signature vulnerability (CWE-347) exists in the firmware update handler of the management service (uavmonitor_usbv1) on the 1300 communications board of DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an unauthenticated attacker on the local network to install modified firmware by supplying any image matching an MD5 checksum without proper signature verification, resulting in persistent root code execution. Exploitation requires network access to TCP port 16000 and that the device is not connected to another controlling host. The vulnerability affects discontinued products with no available fixes.

A reflected Cross-site Scripting (XSS) vulnerability exists in Sarah Giles Dynamic User Directory (dynamic-user-directory) affecting versions up to 2.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in a user's browser. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity.

Eclipse AAS4J versions before 3.0.1 contain a vulnerability in the XmlSchemaValidator.validateSchema() method, which uses a default JAXP Validator that allows resolution of external DTDs and entities. This enables an attacker supplying a crafted AAS XML document or AASX package to read local files on the host and exfiltrate their contents, as well as perform server-side request forgery (SSRF) by making the validator send arbitrary outbound requests. The validation process does not report errors despite the malicious activity. The vulnerability is fixed in version 3.0.1 by disabling external DTD and schema access and rejecting DOCTYPE declarations.

A missing authorization vulnerability exists in Everestthemes Everest Backup up to version 2.3.15. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability does not affect confidentiality or availability but can cause integrity issues.

The Hotel Booking Lite plugin (up to version 2.5.1) contains an unrestricted file upload vulnerability that allows attackers with limited privileges to upload files with dangerous types, such as web shells, to the web server. This vulnerability can lead to complete compromise of the affected system.

A stored cross-site scripting (XSS) vulnerability exists in WP Go Maps up to version 10.1.10. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.