| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an
unauthenticated attacker to create or write into existing files on the
server with attacker-controlled content. This is possible because user
input is written directly to files without proper validation or
restriction on file types. As a result, an attacker can create files
(e.g., .htm), containing malicious JavaScript code. When a user accesses
a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts
an arbitrary path, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables au-thenticated attackers
to trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a
@@INCLUDE command, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables authenticated attackers to
trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm)
accepts a “pathname” parameter, which can be set to network locations
using UNC paths (e.g., “\\Server\Share”). The server processes these
paths without validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables authenticated attackers to
trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot”
parameter, which can be set to network locations using UNC paths (e.g.,
“\\Server\Share”). The server processes these paths without validation,
resulting in outbound connection attempts to attacker-controlled SMB
servers. This enables unauthenticated attackers to trigger the server to
authenticate to arbitrary SMB endpoints, potentially exposing NTLM
authentication information (such as NTLM hashes). If outbound
connections to port 445 (SMB) are permitted, attackers can use this to
conduct SMB relay or credential theft attacks. Exploitation of the
“pathnameroot” parameter is possible without authentication.This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds
with memory. By repeatedly
requesting this endpoint, an attacker can access sensitive
information, including user passwords. Exploitation does not require
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the
request body in the application's link storing functionality
(//ServerClient_celink.htm), which is appended to the redirect target in
the 302 HTTP response. If a line feed is added, this will also be added
to the redirect link, resulting in the ability to control the response
headers. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. |
| An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role. |
| Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting.
This issue affects GastroMenum Web Panel: before 31.08.2026. |
| The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata. |
| The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'. |
| The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login. |
| The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role. |
| The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it. |
| The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files. |
| Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings. |
| In the Linux kernel, the following vulnerability has been resolved:
bpf: Add missing access_ok call to copy_user_syms
As reported by sashiko we use __get_user without prior access_ok call on the
user space pointer. Adding the missing call for the whole pointer array.
Plus removing the err check in the error path, because it's not needed and
also we can return -ENOMEM directly from the first kvmalloc_array fail path.
[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/ |
| In the Linux kernel, the following vulnerability has been resolved:
nfc: microread: validate target discovery payload lengths
microread_target_discovered() parses target discovery payloads from
skb->data according to the HCI gate. The fixed field offsets and UID
copies were checked only against the destination nfc_target buffers, not
against the actual skb length.
Validate that each gate-specific payload contains the fixed fields and
UID bytes before reading or copying them. |
| In the Linux kernel, the following vulnerability has been resolved:
nilfs2: reject invalid block index in GC ioctl
Syzbot reported list corruption caused by a double list_add_tail() call on
bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers().
Analysis revealed that the root cause was the insertion of a page/folio
with a page index of ULONG_MAX into the page cache via the GC ioctl.
filemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(),
repeatedly detects a dirty folio with a page index of ULONG_MAX due to
index wrap-around, leading to duplicate processing of dirty buffers.
As a preparatory step, the GC ioctl loads the page/folio of the block to
be moved during GC and inserts it into the page cache based on information
in the nilfs_vdesc structure passed as an argument. Normally, this does
not cause issues because the user-space GC library configures the
nilfs_vdesc structure properly. However, since there is no range check on
the parameters determining the page index, a request with artificially
crafted parameters -- such as those generated by Syzbot -- can result in a
page/folio being inserted with a page index of ULONG_MAX, triggering the
above problem.
This resolves the issue by checking the ranges of 'vd_offset' and
'vd_vblocknr' in the nilfs_vdesc structure that determine the page index,
thereby preventing the invalid page/folio insertions. |
| Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma compiles this with regexp.MustCompile(s.Pattern) and tests it with patternRe.MatchString(str), an UNANCHORED match. Because the pattern is not anchored (^...$), any string that merely CONTAINS one [a-z0-9-] substring passes validation. A slug such as ../../../../../../tmp/escape is accepted and stored verbatim. The data-export CLI commands (note-mark migrate export and note-mark migrate export-v1) join these unsanitized slugs straight into the output path with path.Join / filepath.Join, then os.MkdirAll the directory and os.Create the note file. path.Join resolves the ../ segments, so the note content file is written OUTSIDE the configured export directory. The export process commonly runs as root (default in Docker / bare-metal admin usage), so this is a root-privilege arbitrary directory create + file write. This issue has been patched in version 0.19.5. |
