netrek-client-cow versions through 3.3.3 have a stack-based buffer overflow vulnerability in the handleSMessage() function within short.c. This flaw allows malicious Netrek servers or man-in-the-middle attackers on the plaintext TCP connection to send oversized SP_S_MESSAGE packets that overflow a 100-byte stack buffer, potentially crashing the client application.
go-chi chi versions 5.2.2 through 5.5.0 contain an open redirect vulnerability in the RedirectSlashes middleware. This flaw allows attackers to craft URLs with embedded tab characters that bypass existing fixes and redirect users to external hosts. The vulnerability exploits how browsers handle URL-encoded tabs in the 301 Location header, enabling protocol-relative URL redirection.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions. This issue arises from improper restriction of rendered UI layers or frames, potentially enabling unauthorized access to certain interface elements or functions. The vulnerability has a medium severity rating with a CVSS score of 4.6.
vtenext versions before 25.02.1 contain an authentication bypass vulnerability that allows unauthenticated attackers to change any account password without token verification. By exploiting the hub/rpwd.php endpoint with a known valid user_name, attackers can invoke a password change action and gain administrator access if two-factor authentication is not enabled.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by exploiting improper validation of user-influenced resource identifiers. The vulnerability does not impact confidentiality or integrity but affects availability.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where a remote authenticated attacker could obtain sensitive information due to a missing required cryptographic step. The vulnerability has a medium severity with a CVSS score of 4.3. No patch or remediation information is currently provided.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability where a remote authenticated attacker can bypass security restrictions due to the absence of the X-Content-Type-Options header, which allows MIME type sniffing. This vulnerability has a medium severity with a CVSS score of 5.4. No patch or remediation information is provided.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to perform HTTP response splitting due to improper neutralization of HTTP headers. This flaw can be exploited to manipulate HTTP responses, potentially leading to web cache poisoning or cross-user attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where TLS certificate validation is improperly implemented. This flaw could allow an attacker to perform a man-in-the-middle attack and obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9.
vtenext versions prior to 25.02.2 contain an SQL injection vulnerability in the modules/Fax/EditView.php component. This flaw allows authenticated users with low privileges to inject SQL via a crafted fieldname parameter. Exploitation can lead to unauthorized reading of database contents, including sensitive password reset tokens, enabling account takeover of other users.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where remote authenticated attackers can obtain sensitive information. This occurs due to error messages that expose internal implementation details. The vulnerability has a medium severity with a CVSS score of 4.3.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability that allows an authenticated attacker to execute arbitrary code on consumer applications. This occurs due to insecure deserialization of ObjectMessage payloads.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to the absence of a Content Security Policy header. This issue has a low severity rating and does not impact system integrity or availability.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to cause a denial of service by consuming resources uncontrollably. The issue does not impact confidentiality or integrity but affects availability. The vulnerability has a low severity score and no known exploits in the wild. No patch or remediation information is currently provided.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to improper access control. The flaw impacts the integrity of the system but does not affect confidentiality or availability. No patch or remediation information is currently provided.
vtenext versions prior to 25.02.2 have a vulnerability where the PHPSESSID session identifier is disclosed via the Touch web service endpoint. This exposure allows attackers who can execute scripts within the vtenext origin, such as through cross-site scripting (XSS), to bypass the HttpOnly flag and hijack authenticated sessions.
A critical authentication bypass vulnerability exists in Linksys E5350 version 1.0.00.037 in the Setup Wizard component. The flaw is triggered by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. This vulnerability can be exploited remotely without authentication, potentially allowing full compromise. Public exploit code is available, but the vendor has not responded or issued a patch.
Sonatype Nexus Repository 3 contains a vulnerability where it does not require realm administration permission when a user creates a Rut Auth capability. This allows a user with only the capability creation permission to enable header-based authentication, enabling remote clients to authenticate as any existing user, including administrators, without credentials.
The WPO365 | LOGIN (wpo365-login) plugin before version 45.2 has an authentication bypass vulnerability due to a capture-replay flaw. This occurs because the anti-replay check in the Saml2_Service::check_message_id() function does not persist processed SAML message IDs, allowing attackers to reuse a valid SAMLResponse multiple times within its validity window to log in as the victim, including administrators.
vtenext versions prior to 25.02.2 have a reflected cross-site scripting (XSS) vulnerability in the HomeWidgetBlockList.php module. This flaw arises because unsanitized widgetId keys from the widgetInfoList JSON parameter are echoed back, allowing attackers to inject malicious HTML/JavaScript. Exploitation requires a logged-in user to submit a crafted POST request, which then executes JavaScript in the victim's session.