IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to improper access control. The flaw impacts the integrity of the system but does not affect confidentiality or availability. No patch or remediation information is currently provided.
vtenext versions prior to 25.02.2 have a vulnerability where the PHPSESSID session identifier is disclosed via the Touch web service endpoint. This exposure allows attackers who can execute scripts within the vtenext origin, such as through cross-site scripting (XSS), to bypass the HttpOnly flag and hijack authenticated sessions.
A critical authentication bypass vulnerability exists in Linksys E5350 version 1.0.00.037 in the Setup Wizard component. The flaw is triggered by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. This vulnerability can be exploited remotely without authentication, potentially allowing full compromise. Public exploit code is available, but the vendor has not responded or issued a patch.
Sonatype Nexus Repository 3 contains a vulnerability where it does not require realm administration permission when a user creates a Rut Auth capability. This allows a user with only the capability creation permission to enable header-based authentication, enabling remote clients to authenticate as any existing user, including administrators, without credentials.
The WPO365 | LOGIN (wpo365-login) plugin before version 45.2 has an authentication bypass vulnerability due to a capture-replay flaw. This occurs because the anti-replay check in the Saml2_Service::check_message_id() function does not persist processed SAML message IDs, allowing attackers to reuse a valid SAMLResponse multiple times within its validity window to log in as the victim, including administrators.
vtenext versions prior to 25.02.2 have a reflected cross-site scripting (XSS) vulnerability in the HomeWidgetBlockList.php module. This flaw arises because unsanitized widgetId keys from the widgetInfoList JSON parameter are echoed back, allowing attackers to inject malicious HTML/JavaScript. Exploitation requires a logged-in user to submit a crafted POST request, which then executes JavaScript in the victim's session.
vtenext versions before 25.02.2 have a vulnerability where the CSRF protection mechanism can be bypassed. The function csrf_check() in include/utils/VteCsrf.php does not validate the __csrf_token for non-POST requests, allowing attackers to trick logged-in users into executing state-changing GET requests. This can lead to unauthorized actions performed with the user's privileges.
Sonatype Nexus Repository 3 has a vulnerability where it exposes the signing passphrase of an APT or YUM repository through an internal REST endpoint. This exposure occurs even to user accounts with only read privileges for administering the repository, without requiring edit privileges.
Sonatype Nexus Repository 3 Pro has a vulnerability where it does not verify the local account status when users authenticate via configured SAML or OAuth2/OpenID Connect identity providers. This allows users whose local accounts are disabled or locked to regain access if they have valid credentials at the identity provider, receiving a new session with their assigned roles.
Sonatype Nexus Repository 3 has an authorization bypass vulnerability where a user with valid credentials and add or edit privileges on a group repository can add a repository they are not authorized to access. This allows the user to read content from that unauthorized repository via the group repository. Anonymous users can only exploit this if explicitly granted the necessary privileges by an administrator.
Sonatype Nexus Repository 3 has a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. This task is only available if the non-default setting nexus.reindex.search.by.pattern.visible is enabled. A user with the nexus:tasks:create privilege can supply a crafted filter condition that is executed as SQL, allowing modification of the Nexus database.
Sonatype Nexus Repository 3 has a vulnerability where an account with only read privileges on a YUM proxy or group repository can obtain the private signing key of that repository. This key allows the holder to sign repository metadata, potentially compromising repository integrity. The vulnerability does not require edit privileges, only read access.
A vulnerability in Sonatype Nexus Repository 3 allows a user with edit permissions on a hosted OCI repository to inject script content into the artifact type field of an OCI manifest. This script executes in the browser of any user who views the Attestations tab for the related image in the Browse UI, running with the permissions of the viewing user. This cross-site scripting (XSS) vulnerability can lead to unauthorized script execution in the context of the Nexus Repository web interface.
DeepSeek Harness versions prior to 0.1.2-alpha.2, specifically commit 3e24087, have a missing authentication vulnerability in the web profile HTTP and WebSocket RPC control plane. This flaw allows any local process, including those running under different OS users, to access unauthenticated session methods such as session.create and session.prompt. Exploitation enables attackers to execute arbitrary commands as the victim user, intercept live session traffic and logs, and bypass human tool-approval checks.
A cross-site scripting (XSS) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.2 in the Images API component, specifically in the file api/utils/file_utils.py. The vulnerability can be exploited remotely and allows an attacker to execute malicious scripts. A public exploit is available. Upgrading to version 0.27.3 addresses this issue.
Yealink Plug-in Softwares prior to version 2.35.219.0 contain an unauthorized file write vulnerability that can be exploited under certain conditions to achieve remote code execution. This vulnerability is critical and has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability.
A critical OS command injection vulnerability exists in Linksys E5350 version 1.0.00.037 in the /wizard/apply.cgi file. The flaw arises from manipulation of the ping_ip or traceroute_ip arguments, allowing remote attackers to execute arbitrary OS commands. Public exploit code is available, but the vendor has not responded or provided a fix.
Yealink MeetingBoard Pro versions before 331.320.0.64 contain a front-end validation bypass vulnerability in the Web management module. An attacker with administrator privileges on the local network can manipulate the page DOM to bypass UI control logic and invoke screenshot functions that are normally restricted. Exploitation requires a valid administrator account and local network access.
Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 are vulnerable to an attack by an adversary with short-term physical access. The attacker can extract Wi-Fi credentials through the USB interface and abuse sensitive firmware configuration data to gain root privileges. This enables audio and video eavesdropping within Wi-Fi coverage without triggering any LED alerts on the device.
A critical OS command injection vulnerability exists in the Ping Diagnostic component of Linksys WRT54GL version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the ping_ip argument allows remote attackers to execute arbitrary OS commands. The vulnerability is publicly known with available exploit code. However, the affected product is no longer supported by the vendor, and no patch or official response has been provided.