What needs attention now.

@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

• Hard-coded credentials

<1.18.4 || >=2.0.2, <2.7.7 || >=3.0.1, <3.9.7 || >=4.0.1, <4.0.3 · fixed in 1.18.4, 2.7.7, 3.9.7, 4.0.3

D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write

• D-Link DIR-822A
• Memory corruption

D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow

• D-Link DIR-895L
• Memory corruption

Improper Access Control in SAP NetWeaver (SAP GUI for Java)

• SAP_SE SAP NetWeaver (SAP GUI for Java)
• CWE-807

Missing Authentication check in SAP NetWeaver (Message Server)

• SAP_SE SAP NetWeaver (Message Server)
• CWE-308

Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

• SAP_SE SAP Extended Passport (EPP) Processing
• Memory corruption

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request.

• Broken access control

An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password.

• Authentication bypass

An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message.

• Code injection

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders,…

• Broken access control

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data.

• SQL injection

Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore.

• SQL injection

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context…

• Cross-site scripting (XSS)

knowns before 0.30.0 Unauthenticated Management API Exposure

• knowns
• Authentication bypass

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

• Adobe Commerce
• Adobe Commerce B2B
• Code injection

Missing authentication in JetBrains Hub

• JetBrains Hub
• Authentication bypass

Authentication bypass by spoofing in JetBrains YouTrack

• JetBrains YouTrack
• Authentication bypass

Code Injection in Next4Biz's CSM (Customer Service Management)

• Next4Biz Information Technologies Inc. CSM (Customer Service Management)
• Insecure deserialization

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Authentication bypass

Execution with unnecessary privileges in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Privilege escalation

LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion

• librenms
• Authentication bypass

OTP Bypass in Bahçelievler Muncipality's BiHayat App

• Bahçelievler Muncipality BiHayat App
• Authentication bypass

Missing authorization in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Broken access control

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Authentication bypass

Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection

• Linksys RE7000
• Command injection

D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one

• D-Link DIR-605
• CWE-189
• CWE-193

D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow

• D-Link DIR-822A
• Memory corruption

Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection

• Advantech WISE-6610-NB
• Advantech WISE-6610-EB
• Other injection
• Command injection

Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection

• Advantech WISE-6610-NB
• Advantech WISE-6610-EB
• Other injection
• Command injection

Missing authentication in NEC Corporation UNIVERGE IX-R/IX-V

• NEC Corporation UNIVERGE IX-R/IX-V
• Authentication bypass

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

• Weak cryptography or TLS

Negotiate ambient user conn reuse

• curl
• CWE-488

HTTP/2 server push UAF

• curl
• Memory corruption

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

• Authentication bypass

OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

• THU-MAIC OpenMAIC
• Authentication bypass
• Server-side request forgery (SSRF)

Tenda HG10 Boa formgponConf os command injection

• Tenda HG10
• Command injection

Tenda HG10 formURL buffer overflow

• Tenda HG10
• Memory corruption

Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

• shabti Frontend Admin by DynamiApps
• Authentication bypass

MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter

• LearnDash MemberDash
• Broken access control

pre-authentication remote code execution

• N-able N-central
• Code injection

Tenda CP3 Redirect.cpp SetRedirectEnable privileges management

• Tenda CP3
• Privilege escalation

Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection

• Tenda CP3
• Command injection

Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection

• Tenda CP3
• Command injection

Tenda CP3 NetCheckPing.cpp os command injection

• Tenda CP3
• Command injection

Tenda CP3 Kylin system.c SystemAsh os command injection

• Tenda CP3
• Command injection

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

• Mikrotik RouterOS
• Command injection

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

• Mikrotik RouterOS
• CWE-841

Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

• Mikrotik RouterOS
• Authentication bypass

SSH user impersonation possible in Mikrotik RouterOS

• Mikrotik RouterOS
• Weak cryptography or TLS

WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter

• WWBN AVideo
• Information disclosure

WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

• WWBN AVideo
• Path traversal

Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

• laradashboard
• Authentication bypass

Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

• getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
• Insecure deserialization

AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server

• HKUDS AutoAgent
• Authentication bypass

SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints

• sqlchat
• Server-side request forgery (SSRF)

Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

• trycua cua-computer-server
• Authentication bypass

Webstudio through 0.296.0 SSRF via /cgi proxy routes

• webstudio
• Server-side request forgery (SSRF)

Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

• coollabsio coolify
• Authentication bypass

Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

• pickplugins Post Grid
• Code injection

Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator

• Path traversal

<0.47.5 · fixed in 0.47.5