Search: 13.3-13

Nodemailer has a vulnerability in its address parser where RFC 5322 comments inside angle-bracket email addresses are not stripped. This causes the comment text and parentheses to be included verbatim in the parsed address, leading to malformed SMTP commands that are rejected by mail servers. The issue affects versions from 3.0.0 up to but not including 10.0.13 and is distinct from previously patched comment handling bugs. A fix is available in version 10.0.13.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.

Wails v2 contains a vulnerability in its origin validation logic where wildcard patterns in BindingsAllowedOrigins are improperly converted to regular expressions. This allows origins with suffixes matching the allowed pattern to bypass restrictions and invoke Go backend methods. The issue affects versions before 2.13.0 and can lead to unauthorized access to file systems, databases, or command execution depending on the exposed API surface. A fix is available in version 2.13.0.

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Ajenti versions prior to 2.2.13 contain a critical remote code execution vulnerability (CVE-2026-27975) that allows unauthenticated users to execute arbitrary code on the affected server. This vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed. The issue is fixed in version 2.2.13, and users are strongly advised to upgrade to this version promptly to mitigate the risk.

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, including specific LTS2024, LTS2025, and LTS2026 release versions, contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.9 (medium severity). No patch or remediation information is provided in the available data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper access control vulnerability. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 6.5, indicating a medium severity level.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with local access to potentially elevate their privileges further. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw could allow a high privileged attacker with remote access to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. No public exploits or known in-the-wild exploitation have been reported. Patch or remediation information is not provided in the available data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9 (medium severity).

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability allows an unauthenticated remote attacker to potentially perform SSRF attacks against the server.

A critical stack-based buffer overflow vulnerability exists in multiple JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager and Agent editions, and JP1/Base. The affected versions range from 13-00 up to but not including 13-50-31 for most products, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows for remote exploitation without privileges or user interaction, potentially leading to high confidentiality and integrity impact with limited availability impact.

A heap-based buffer overflow vulnerability exists in multiple JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager and Agent editions, and JP1/Base. The affected versions range from 13-00 up to but not including 13-50-31 for the first four products, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability has a high CVSS score of 9.4, indicating critical severity with potential for high impact on confidentiality and integrity.

A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This vulnerability has a critical severity with a CVSS score of 9.4, indicating it can be exploited remotely without privileges or user interaction, potentially leading to high confidentiality and integrity impact and some availability impact.

A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 affecting Manager and Agent components from version 11-00 up to but not including 13-50-31. This vulnerability has a critical CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction to cause high impact on confidentiality, integrity, and availability.

An authentication bypass vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This flaw allows an attacker to bypass authentication controls, potentially leading to full system compromise. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

A critical stack-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This vulnerability allows an attacker to execute arbitrary code with no privileges required and no user interaction needed.