CWE-75

Podatność typu SQL injection w komponencie Apache Airflow Providers Snowflake pozwala nieuwierzytelnionemu atakującemu na wstrzyknięcie złośliwych poleceń SQL poprzez niesanityzowane parametry operatora. Ze względu na krytyczny wynik CVSS 9.8 oraz brak wymagań dotyczących uwierzytelnienia, stanowi poważne zagrożenie dla integralności danych i systemu.

Wiele modeli routerów GL-iNet zawiera podatność w endpointcie /cgi-bin/glc, która pozwala nieuwierzytelnionemu atakującemu na zdalne wykonanie kodu lub path traversal. Podatność jest krytyczna, ponieważ nie wymaga żadnych uprawnień ani interakcji użytkownika i jest dostępna zdalnie przez sieć.

Podatność w aplikacji Skycaiji 2.8 umożliwia nieuwierzytelnionemu atakującemu zdalne wykonanie dowolnego kodu (RCE) poprzez spreparowane żądanie POST. Ze względu na brak wymagań co do uprawnień i interakcji użytkownika, podatność stanowi krytyczne zagrożenie dla każdego publicznie dostępnego systemu.

Mocodo Online w wersji 4.2.6 i wcześniejszych zawiera krytyczną podatność umożliwiającą zdalne wykonanie kodu (RCE) poprzez endpoint /web/rewrite.php. Atakujący bez uwierzytelnienia i bez interakcji użytkownika może przejąć kontrolę nad serwerem.

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SSRF and even attacks leading to RCE. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. As a workaround, you may review your code to verify no untrusted or unsanitized input is passed to "ServiceFactory.getService", or by applying the patch from https://github.com/apache/axis-axis1-java/commit/7e66753427466590d6def0125e448d2791723210 . The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Podatność typu iframe injection w aplikacji MyNET firmy Airc (wersja 26.06 i wcześniejsze) umożliwia zdalnemu atakującemu wykonanie dowolnego kodu. Wysoki wynik CVSS 9.6 oraz wpływ na poufność, integralność i dostępność czynią ją podatnością krytyczną.

Podatność typu header injection w Apache APISIX pozwala nieuwierzytelnionemu atakującemu na wstrzykiwanie złośliwych nagłówków HTTP poprzez odpowiednią konfigurację pluginu forward-auth. Uzyskanie kontroli nad nagłówkami żądań może prowadzić do naruszenia poufności i integralności przetwarzanych danych.

A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such that it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges, by poisoning any of the content used to generate XLS reports, could be able to leverage the application to deliver malicious files against higher-privileged users and obtain Remote Code Execution (RCE) against the administrator’s workstation.

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell Runtime component contains a command injection vulnerability in how it processes user-supplied arguments. When a function is invoked via HTTP, the runtime reads the X-Nuclio-Arguments header and directly incorporates its value into shell commands without any validation or sanitization. This issue has been patched in version 1.15.20.

WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality.

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is "it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not."

An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.

An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to elevate privileges.

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.