New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Yamaha YMS-VPN8: Unquoted service path allows privilege escalation

YMS-VPN8 and YMS-VPN8-CP, VPN client software for Windows, register Windows services with unquoted file paths. A local user with write permissions on the system drive can place a program along the path and have it run with SYSTEM privileges. The attacker needs an existing local foothold, and the vulnerability is not network-exploitable.

Yamaha Corporation · YMS-VPN8 / YMS-VPN8-CP

Yamaha NWR100: OS command injection in web GUI request handling

The Yamaha NWR100 wireless LAN router firmware up to Rev.26.00.07 contains an OS command injection vulnerability (CWE-78). An attacker who sends a specially crafted request to the device can execute arbitrary OS commands without authentication. The web GUI must be reachable by the attacker, for example from a device on the LAN or Wi-Fi, because it is not exposed to the internet by default.

Yamaha Corporation · NWR100

NEX-Forms WordPress plugin: Unauthenticated stored cross-site scripting

NEX-Forms, a WordPress form builder plugin, contains a stored cross-site scripting (XSS) vulnerability (CWE-79) in the 'type' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages, which execute whenever a user opens an injected page. The CNA rates the issue at CVSS 3.1 7.2 (High); VulDB scores it 4.3.

webaways · NEX-Forms – Ultimate Forms Plugin for WordPress

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

oapi-codegen: Code injection via non-string enum values in OpenAPI specs

oapi-codegen versions 2.0.0 up to 2.8.0 allow code injection through non-literal enum entries in integer, number or boolean schemas of an OpenAPI document. An attacker who controls the OpenAPI document can craft an enum entry that closes the const block in the code template and inserts a func init() function. The injected code runs when the generated package is built and imported, typically on developer machines or CI runners. The NVD rating (CVSS 4.0 8.7) assumes that a user must process the malicious document (UI:P).

oapi-codegen · oapi-codegen

oapi-codegen: Code injection via crafted servers[].x-go-name value

oapi-codegen, a Go tool that generates Go code from OpenAPI specifications, does not escape the servers[].x-go-name value in its server-urls template. An attacker who controls an OpenAPI document can inject Go code, including a func init() that runs when a victim builds or imports the generated package. The attack requires that a developer or CI/CD pipeline generates code from the malicious document.

oapi-codegen · oapi-codegen

open npm package: OS command injection via PowerShell on Windows

The npm package open (versions 7.2.0 to before 11.0.0) can execute PowerShell code on Windows and WSL when crafted URLs are passed to it. Attackers can embed $(...) subexpressions in URLs, for example OAuth authorization_endpoint values from malicious MCP servers, which run when the package passes them unescaped to PowerShell. Exploitation requires a user to open or process such a URL, for example by connecting to a malicious MCP server.

sindresorhus · open

NewsmanApp: Stored Cross-Site Scripting via billing name fields

The NewsmanApp WordPress plugin up to and including version 3.7.29 does not properly sanitise or escape the billing first name and billing last name fields. An unauthenticated attacker can store malicious scripts that run in the browser of any user who opens an affected page. The flaw only applies when Newsman Remarketing is enabled and a non-empty Remarketing ID is configured.

Newsman · NewsmanApp

Newsmatic WordPress theme: Unauthenticated blind SQL injection via slug parameter

The Newsmatic theme for WordPress does not sufficiently escape the 'slug' parameter and does not use prepared SQL statements. An unauthenticated attacker can append SQL queries to existing database queries over the network. This can be used to extract sensitive information from the database, such as user accounts and password hashes, on any public site running the affected theme.

blazethemes · Newsmatic

Yamaha NWR100: Insecure storage of sensitive information in configuration export

The Yamaha wireless LAN router NWR100 stores configuration files generated by its CONFIG export function insecurely. An unauthenticated attacker who can reach the Web GUI can read these exported configuration files. By default the Web GUI is not reachable from the internet, but it is reachable from devices connected over the wireless LAN, and the impact depends on what the file contains, which the public advisories do not specify.

Yamaha Corporation · NWR100

Research and translation in progress – available shortly.

Yamaha LAN Monitor for Windows: Insecure DLL loading in installer

The installer of Yamaha LAN Monitor for Windows up to version 1.9.3 loads Dynamic Link Libraries from an insecure search path. If the installer is started from a directory containing a specially crafted DLL, the DLL is loaded and code runs with administrative privileges. The attacker must place the file locally and the user must run the installer; the issue affects only installation and not already installed copies.

Yamaha Corporation · Yamaha LAN Monitor for Windows