Dell PowerStore contains a content-injection vulnerability that allows an unauthenticated attacker to inject misleading text on the legitimate login page. This vulnerability could be exploited to facilitate phishing attacks by deceiving users. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A path traversal vulnerability exists in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in certain Zenitel devices running software versions from 10.0.3.0 up to but not including 10.1.3.0. Authenticated administrators can exploit this flaw by providing a crafted filename parameter with the type field set to any value other than https_certificate, bypassing path and certificate content validation. This allows arbitrary file write as root, which can lead to root-level arbitrary code execution by overwriting startup scripts or planting SSH keys.
Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability that allows authenticated administrators to execute arbitrary commands as root. This occurs via injection of newlines into the IPsec keyexchange field of the vpn.set_conf RPC method, enabling attackers to append malicious directives to the ipsec.conf file. The vulnerability leverages StrongSwan's updown plugin, which executes the appended commands with root privileges when an attacker-controlled peer establishes a CHILD_SA.
A vulnerability in Zenitel Connect firmware versions before 1.11.0 allows local attackers to execute database operations as the PostgreSQL superuser. The pREST database REST API signs and verifies JWTs using the platform CA private key, which is stored on a shared data volume accessible between containers. Attackers who can read this private key can forge JWTs with the sub claim set to 'postgres', enabling them to perform privileged database actions, including reading sensitive data such as the master encryption key and password hashes.
RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 has an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service exposed on TCP port 2001. This flaw allows remote attackers to send malicious serialized payloads to achieve remote code execution as NT AUTHORITY\SYSTEM, fully compromising the host.
A path traversal vulnerability exists in the certificate.deleteCertificate JSON-RPC method of the turbineweb web interface in certain Zenitel devices. Authenticated administrators can exploit this flaw by providing a relative path in the file_name parameter to delete arbitrary files as root. This can lead to denial of service or device inoperability by removing critical system files, including security-related files such as firewall rules or certificate trust stores.
An OS command injection vulnerability exists in the audio messages API of Zenitel Connect versions before 1.11.0. This flaw allows remote authenticated users to execute arbitrary operating system commands as root within the hiatus application container by exploiting the filename parameter in the /api/system/audio_messages endpoint.
A vulnerability in Zenitel Connect before version 1.11.0 allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host. This occurs because the host configuration watcher applies a rsyslog configuration file from a shared data volume, which can be crafted maliciously.
Cudy TR3000 devices running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by uploading specially crafted OpenVPN private or tls-auth keys. The attack involves closing the inline key block prematurely and injecting directives that bypass security restrictions, allowing OpenVPN to execute arbitrary commands as root.
sysPass versions 3.0.1 through 3.2.11 have an authentication bypass vulnerability that allows unauthenticated attackers to reinstall the application by sending a POST request to the install handler. This bypass occurs because the install handler does not verify if the application is already installed. Exploitation enables attackers to overwrite configuration files, redirect the application to an attacker-controlled database, create administrator accounts, and execute arbitrary commands via crafted serialized gadget chains.
Cudy TR3000 devices running firmware versions before 2.5.42 have a mass assignment vulnerability in the vpn.set_conf App RPC method. This flaw allows authenticated administrators to inject arbitrary OpenVPN server options. Specifically, attackers can enable the VPN and set a malicious 'up' option that is executed by the openvpn-hotplug wrapper with root privileges via /bin/sh.
Zenitel Connect versions before 1.11.0 expose production JavaScript source map files through the web interface without requiring authentication. This exposure allows remote attackers to access the complete front-end source code, revealing API usage and internal client logic.
Cudy TR3000 devices running firmware versions before 2.5.42 have a vulnerability in the dnsmasq configuration that allows authenticated administrators to inject malicious directives. This is achieved by embedding a newline character in the net.set_dhcp leasetime field, enabling attackers to append or insert lines in the dnsmasq configuration file. Such manipulation can alter DNS responses for LAN clients or disrupt the dnsmasq service entirely.
Cudy TR3000 devices running firmware versions before 2.5.42 have a command injection vulnerability. Authenticated administrators can exploit this flaw by injecting newline characters into the reboot_time parameter, allowing them to add arbitrary commands to the root crontab. This leads to command execution with root privileges.
Cudy TR3000 devices running firmware versions before 2.5.42 have an option injection vulnerability. Authenticated administrators can exploit this flaw by injecting arbitrary pppd options through crafted L2TP credentials. This is achieved by embedding quotes and newlines in usernames or passwords submitted to the net.set_wan RPC method, which writes these inputs into a pppd options file. The vulnerability allows attackers to add options such as logfile to the root pppd process, potentially impacting system integrity and availability.
Dell PowerStore appliances contain an OS Command Injection vulnerability (CVE-2026-103813) that allows an authenticated user with limited privileges to potentially escalate their privileges to root on the appliance. This vulnerability has a high severity score and could lead to full compromise of the affected system.
Cudy TR3000 routers running firmware versions before 2.5.42 have a remote code execution vulnerability. Authenticated administrators can exploit this flaw by importing a malicious OpenVPN client configuration containing specially crafted tls-verify or ipchange directives. These directives bypass an incomplete denylist and allow execution of root commands when the router connects to the attacker-controlled VPN endpoint. This vulnerability enables full control over the device with high impact on confidentiality, integrity, and availability.
Zenitel Connect versions before 1.11.0 have a vulnerability in the login flow where different error messages are returned depending on whether a submitted username exists. This behavior allows remote attackers to enumerate valid user accounts by sending crafted login requests.
A buffer overflow vulnerability exists in the handling of EDID Display-Range descriptors in X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26. This flaw could allow a malicious monitor to crash the X server or potentially execute code with limited privileges. The vulnerability has a high severity rating with a CVSS score of 7.8.
A Ruby object-document mapper fails to apply automatic field-level encryption to certain fields when using class inheritance in the data model. As a result, values intended for encryption are stored in readable form in the database without any error or warning. This allows a database account with read-only access to the application's collections, but no access to the encryption key store, to obtain sensitive plaintext data.