Omnispace Agora Project versions through 26.10.0 have a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to perform privileged actions, such as creating administrator users, by exploiting the merging of $_GET and $_POST parameters without requiring an anti-CSRF token. The vulnerability leverages the absence of CSRF protection combined with SameSite=Lax cookie behavior on top-level navigations, enabling attackers to craft malicious links or auto-navigating pages that issue GET requests to execute unauthorized actions.
Omnispace Agora Project versions through 26.10.0 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious HTML markup via imported directory data or uploaded CSV files. The vulnerability arises because input values are only UTF-8 encoded without proper HTML escaping, enabling crafted CSV cells to execute arbitrary scripts in the administrator's browser during import.
Gameyfin versions before 2.6.2 have a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by accessing certain endpoints. Attackers can call Hilla endpoints annotated with @AnonymousAllowed, including synchronous endpoint methods like GameEndpoint.sync, which are not checked by LiveSubscriptionSecurity. This enables retrieval of game catalog metadata, libraries, platforms, plugins, and game requests without authentication.
MRBS versions prior to 1.13.0 have an LDAP injection vulnerability in the AuthLdap.php component. This flaw allows attackers with valid directory credentials but outside the required group to bypass access restrictions by submitting specially crafted usernames that manipulate LDAP filters.
SQLBot versions through 1.10.3 use unsalted MD5 hashing for storing local account passwords in the sys_user.password field. This weak hashing method allows attackers who access the user table to recover passwords, including administrator credentials, via precomputed hash tables or GPU-accelerated cracking. The vulnerability arises from the use of md5pwd() in security.py, which does not apply salting to the hashes.
Goose CLI versions from 1.35.0 up to but not including 1.53.0 contain a local code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating the diff.external setting in a repository's .git/config file. When a victim runs the 'goose review' command on a crafted repository, it triggers git diff without the --no-ext-diff option, enabling command execution as the user and potentially exposing sensitive credentials and API keys.
C-Kermit versions prior to 11.1.515 have an OS command injection vulnerability that allows remote clients to execute arbitrary shell commands. This occurs when unquoted arguments are supplied to the REMOTE WHO or REMOTE SPACE commands, enabling attackers to append shell metacharacters to arguments passed to syscmd(). This vulnerability can be exploited even if the DISABLE HOST setting is enabled.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a remote code execution vulnerability. This flaw allows attackers to execute shell commands on servers even when host commands are disabled by exploiting REMOTE QUERY evaluation. Attackers can invoke the command function or define and execute macros to bypass restrictions, leading to full compromise. The vulnerability has a high severity score of 8.1 CVSS v3.1.
A local file disclosure vulnerability exists in agent-device versions from 0.21.36 up to but not including 0.21.37. Authenticated remote users can exploit this flaw by sending commands that open file:// URLs via the /rpc interface, allowing them to read any plaintext file accessible by the daemon account.
A critical OS command injection vulnerability exists in the TFTP provisioning module of Zenitel EdgeAudioClient versions before 9.6.3.0 and 10.x before 10.1.3.0. This flaw allows unauthenticated adjacent attackers to execute arbitrary commands as root by supplying a crafted DHCP option 66 value via a rogue DHCP server on the same network segment. The vulnerability affects devices using DHCP on every boot and lease renewal. Additionally, the injection can be triggered through certain configuration fields if an attacker can modify the device configuration.
C-Kermit versions prior to 11.1.515 contain a heap buffer overflow vulnerability in the putsrv() function within ckcfns.c. This flaw allows malicious peers to write beyond the srvcmd buffer by sending specially crafted packets using Kermit repeat-count compression in server command, GET, or file-header packets. The vulnerability can lead to arbitrary code execution or denial of service on affected servers or receiving instances.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a vulnerability in certificate validation. The function ssl_reply() fails to call ssl_check_server_name(), allowing attackers to impersonate Telnet servers. This flaw enables machine-in-the-middle attackers to refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.
C-Kermit versions prior to 11.1.515 contain a vulnerability that allows malicious Kermit servers to bypass the RECEIVE CONFIRM prompt. This flaw enables attackers to write files without user consent by exploiting recursive GET root computation, potentially placing files like .ssh/authorized_keys or shell startup scripts in the current directory. Such unauthorized file writes can lead to persistent access or code execution.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 have a vulnerability in certificate hostname validation. This flaw allows attackers with a trusted certificate containing wildcard characters to impersonate hosts by exploiting improper matching in the DNS name comparison function. Successful exploitation can lead to interception of credentials and data over Telnet, FTP, and HTTP TLS connections.
C-Kermit versions from 7.0.197 up to but not including 11.1.515 contain an authentication bypass vulnerability in the IKSD SSL build. This flaw causes the Telnet authentication state to remain at AUTH_VALID after a refused certificate login. An attacker possessing a trusted certificate mapped to a refused account can exploit this to log in as any other account with any password, gaining shell access to that account.
Eclipse BaSyx Go Components versions up to and including 1.1.3 have an access control bypass vulnerability in ABAC-enabled deployments. The issue arises because access rules match the fully decoded request path, while routing uses the raw encoded path. This discrepancy allows an authenticated user with limited read permissions on parts of a resource to access the entire resource if the resource identifier contains encoded slashes. The vulnerability is fixed in version 1.1.4.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a buffer overflow vulnerability in the getreply() function within ckcftp.c. This flaw allows malicious FTP servers to overwrite client memory by sending excessively long security replies, specifically long PBSZ replies after AUTH TLS or long ADAT replies in certain authentication builds. The vulnerability can be exploited by attackers controlling or intercepting FTP servers to cause memory corruption.
C-Kermit versions from 8.0.200 up to but not including 11.1.515 contain a path traversal vulnerability in the doftpget() function. This flaw allows malicious FTP servers to manipulate file paths during recursive FTP get operations, potentially overwriting sensitive files such as .bashrc. Exploitation requires user interaction and can lead to code execution by overwriting configuration files.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 have a vulnerability that allows malicious senders to bypass file collision protection. This flaw lets attackers append data to existing files by marking transfers as RESEND. The issue arises because the gattr() function clears the REJECT discard flag and switches to APPEND mode without prompting for RECEIVE CONFIRM, enabling unauthorized file modifications such as altering shell startup files.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a buffer overflow vulnerability in the tn_snenv() function within ckctel.c. This flaw allows malicious Telnet servers or man-in-the-middle attackers to send specially crafted NEW-ENVIRON SEND subnegotiation messages before authentication, causing overflow of a 16-byte stack buffer and a miscalculated heap buffer. This memory corruption can compromise client memory integrity.