Cudy TR3000 devices running firmware versions before 2.5.42 have an OS command injection vulnerability. This flaw allows a malicious or compromised Auto Configuration Server (ACS) to execute arbitrary commands as root by sending a specially crafted SetParameterValues request. The vulnerability arises because user-supplied input is concatenated unsafely into a command executed by the system, leading to root-level command execution.
Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability. Authenticated administrators can exploit this flaw by uploading an OpenVPN configuration file with a specially crafted filename containing shell substitution characters. This filename is not properly validated and is passed to a shell command, allowing execution of arbitrary commands as root.
Cudy TR3000 devices running firmware versions before 2.5.42 have an argument injection vulnerability in the easycwmpd Upload handler. This flaw allows a malicious or compromised Auto Configuration Server (ACS) to inject arbitrary curl command options via unfiltered Username and Password fields. Exploitation can enable attackers to write attacker-controlled HTTP responses to arbitrary files on the device, potentially impacting integrity and availability.
Cudy TR3000 routers with firmware versions before 2.5.42 have a remote code execution vulnerability. This flaw allows unauthenticated attackers on the adjacent network segment to execute root commands by advertising a rogue automesh controller via mDNS. The attack involves advertising _cudycmagent._tcp records that point to a malicious MQTT broker and sending commands encrypted with a fixed AES key, which the router executes with root privileges.
Cudy TR3000 devices running versions before 2.5.42 have an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so. The plugin improperly accepts unsigned JWT tokens using the 'alg none' algorithm, allowing attackers with any Cudy-trusted client certificate to authenticate as the admincudydevice user on port 8883. This enables them to publish batchcmd requests that execute commands with root privileges.
Cudy TR3000 devices running firmware versions before 2.5.42 have a stack buffer overflow vulnerability in the CWMP client. This flaw allows a malicious Auto Configuration Server (ACS) to send oversized Username and Password credentials in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and causing the CWMP process to crash.
ExcelJS versions through 4.4.0 have a formula injection vulnerability in the totals row formula getter located in lib/doc/table.js. The vulnerability arises because certain characters ([, ], #, and ') in structured reference column names are not properly escaped. Attackers can exploit this by supplying malicious column names containing the ] character via untrusted input such as imported CSV headers. This can lead to injection of formulas like HYPERLINK that may exfiltrate cell values when users open and interact with the generated workbook.
ExcelJS versions through 4.4.0 have an arbitrary file read vulnerability in the streaming WorkbookWriter component. This flaw allows attackers to read local files by supplying crafted image filenames with ../ path traversal sequences to the addImage function. The vulnerability enables embedding any file readable by the Node.js process into the generated workbook under xl/media.
Dell SmartFabric OS10 Software versions prior to 10.6.0.10 contain an improper access control vulnerability. This flaw allows a low privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability.
Cudy TR3000 devices running firmware versions before 2.5.42 have a vulnerability in the mt_wifi Smart Mesh Technology onboarding process. The vulnerability arises from insufficient verification of data authenticity, where messages are protected only by an AES-CBC key derived from public values and a CRC32 check. This allows adjacent unauthenticated attackers to forge Smart Mesh Technology messages in Probe Request vendor information elements, carrying attacker-chosen SSIDs and pre-shared keys. As a result, unpaired devices can be forced to join attacker-controlled access points.
Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability. Authenticated administrators can exploit this flaw by injecting commands via the WireGuard server private_key option. The vulnerability arises because the private key value is passed unsafely to a system execution function during configuration export, allowing arbitrary root command execution.
ExcelJS versions through 4.4.0 have a resource leak vulnerability in the streaming WorkbookReader.parse function. This flaw causes temporary files and open file descriptors to remain when sheet parsing fails or iteration stops early. An attacker can exploit this by uploading malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml, leading to exhaustion of temporary directory space and file descriptors.
ExcelJS versions up to 4.4.0 have a prototype pollution vulnerability in the mergeConditionalFormattings function. This flaw allows attackers to modify Object.prototype by crafting an xlsx file with a specific x14:cfRule id of __proto__. When such a file is loaded using xlsx.load(), it can set or overwrite properties on all objects processed, potentially causing integrity and availability issues.
Miniflux versions prior to 2.3.5 have a vulnerability that allows an authenticated user with a valid session to change their account password without providing the current password. This flaw enables attackers who have stolen session cookies or access to an unattended device to change the password via the updateSettings function, potentially locking out the legitimate user and taking over the account.
A denial of service vulnerability exists in exceljs through version 4.4.0. Attackers can craft XLSX files with row numbers far beyond Excel's normal limits, causing functions like getSheetValues(), workbook writes, and CSV exports to consume excessive processing time and block the event loop.
ExcelJS versions through 4.4.0 have a denial of service vulnerability where an attacker can supply an unbounded sheetId in the xl/workbook.xml file. This causes the event loop to be blocked for seconds during operations like walking worksheets, getWorksheet, and writeBuffer.
ExcelJS versions through 4.4.0 have a memory exhaustion vulnerability triggered by processing an oversized defined-name range in a workbook. This causes the application to crash with an uncatchable fatal heap out-of-memory error during the loading of XLSX files.
ExcelJS versions through 4.4.0 have a resource exhaustion vulnerability in the data-validations-xform.js component. This flaw allows attackers to supply unbounded sqref ranges in crafted workbooks, causing the xlsx.load() function to iterate over billions of addresses. The result is CPU and memory exhaustion, blocking the event loop and crashing the process with an uncatchable out-of-memory error.
ExcelJS versions through 4.4.0 have a memory exhaustion vulnerability where an attacker can crash applications by providing a workbook with an extremely large image anchor column value. This causes excessive memory allocation leading to a heap out-of-memory error.
ExcelJS versions through 4.4.0 have a regular expression denial of service (ReDoS) vulnerability in the slideFormula function within lib/utils/shared-formula.js. This occurs when processing shared formulas in spreadsheets, where crafted inputs with very long master formulas can cause excessive regex backtracking, blocking the Node.js event loop and causing a denial of service.