Improper Mattermost exception handling vulnerability

Mattermost versions 11.7.11 and earlier in the 11.7.x series contain an improper exception handling vulnerability. This vulnerability arises from the failure to validate empty elements when decoding playbook import conditions; it may allow authenticated attackers to trigger a crash within Playboo...

MetInfo path traversal vulnerability

Versions prior to MetInfo 6.1.1, specifically version 6.0.0, contain a path traversal vulnerability. This vulnerability stems from a path traversal issue in the dir parameter within the file /include/thumb.php. Attackers can send specially crafted requests containing backslashes to bypass...

midgetspy Sickbeard cross-site scripting vulnerability

The midgetspy Sickbeard vulnerability stems from a cross-site scripting flaw. This arises due to improper handling of the “pattern” parameter in /config/postProcessing/testNaming; the testNaming handler fails to escape returned content. As a result, unauthenticated attackers can craft GET request...

WordPress ShopMagic information disclosure vulnerability

WordPress ShopMagic versions 4.9.1 and earlier contain an information disclosure vulnerability. This vulnerability arises from the insertion of sensitive information into externally accessible files or directories, potentially allowing attackers to retrieve the embedded data...

GitLab numeric error vulnerability

A numerical error vulnerability exists in GitLab CE/EE versions from 7.0 up to and including 18.11.13, in version 19.0 prior to 19.0.10, in version 19.1 prior to 19.1.9, in version 19.2 prior to 19.2.9, in version 19.3 prior to 19.3.6, in version 19.4 prior to 19.4.3, and in version 19.5 prior to...

Pascal Buchbinder mod_qos numerical error vulnerability

Versions 11.74, 11.76, and 11.79 of Pascal Buchbinder’s modqos contain a numeric error vulnerability. This vulnerability arises from an off-by-one pointer calculation when merging request body parameters with existing URL query parameters. As a result, the query string is truncated during securit...

LocalStack security vulnerability

A security vulnerability exists in LocalStack version 4.9.2. It arises when a URL hosting specially crafted content is passed as templateURL to the localstack/cloudformation/deploy endpoint, potentially allowing arbitrary code execution within a Docker container environment...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail::extractinlineimages fails to validate the media type within inline image data URIs. Remote authenticated attacke...

Traefik Labs Traefik authorization issue vulnerability

In Traefik Labs Traefik versions 3.7.13 through 3.7.14, there is an authorization issue vulnerability. This vulnerability stems from HTTP router generation in the Kubernetes Ingress NGINX provider for non-TLS ingress points; no access control annotations are applied to generated routes. As a...

Roundcube Webmail Project Roundcube Webmail permission and access control issues vulnerability

The Roundcube Webmail project contains a permission and access control vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from CSS scope bypass in HTML messages. The rcubeutils::modcssstyles function fails to treat the “at-rule” prefix as a selector...

GitLab authorization issue vulnerability

GitLab CE/EE versions prior to 15.10 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks on user-supplied project filtering parameters within the group milestone API. As a result,...

KNIME Business Hub SaaS information disclosure vulnerability

Versions prior to KNIME Business Hub SaaS 1.19.0 contain an information disclosure vulnerability stemming from improper authorization. This vulnerability may allow unauthorized remote users to obtain basic account information...

GitLab input validation error vulnerability

Versions 17.4 prior to GitLab EE 19.3.6, version 19.4 prior to 19.4.3, and version 19.5 prior to 19.5.1 contain an input validation error vulnerability. This vulnerability stems from improper access control during synchronization of approval rules, potentially allowing authenticated users to bypa...

ABB Ability Edgenius authorization issue vulnerability

ABB Ability Edgenius versions 3.2.3.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing unauthorized access to these functions...

GitLab trust management issue vulnerability

GitLab EE versions prior to 17.8 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain a trust management vulnerability. This vulnerability stems from insufficient server-side validation during billing eligibility checks, potentially allowing authenticated users to access paid AI...

WordPress User Profile Builder permission and access control issue vulnerability

WordPress User Profile Builder versions 4.0.4 and earlier contain a privilege escalation vulnerability related to permission handling and access control. This issue stems from improper permission allocation and may lead to privilege escalation...

Georg Sieber Open Computer Orchestration Cross-site Scripting Vulnerability

Versions of Georg Sieber Open Computer Orchestration prior to 1.2.1 contain a cross-site scripting vulnerability. This vulnerability arises because Html::commandButton embeds action URLs containing stored computer hostnames into JavaScript strings within its inline onclick handler; only HTML...

Kavita path traversal vulnerability

Versions Kavita 0.5.2 through 0.5.4.1 contain a path traversal vulnerability. This vulnerability arises because the filename parameter allows path traversal; unauthenticated attackers can send GET requests containing ../ sequences to /api/image/cover-upload to read any file outside the temporary...

i-Netsolution Readymade Unilevel Ecommerce MLM SQL injection vulnerability

The i-netsolution Readymade Unilevel Ecommerce MLM version for 2024-03-15 contains an SQL injection vulnerability. This flaw stems from improper input validation of the id parameter in /product-details.php. Unauthorized attackers can exploit this by sending boolean, stack-based, or time-based SLE...

TMS Amelia SQL injection vulnerability

TMS Amelia versions 2.4.11 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, making them susceptible to SQL injection attacks...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.1 of CNCF OpenTelemetry Python contain a resource management error vulnerability. This vulnerability stems from the TraceState.fromheader function in opentelemetry/trace/span.py within the opentelemetry-api. When parsing W3C trace state headers, it uses an...

PHPOffice PhpSpreadsheet resource management error vulnerability

Versions prior to PHPOffice PhpSpreadsheet 1.30.7, versions 2.0.0 through 2.1.19, versions 2.2.0 through 2.4.8, versions 3.3.0 through 3.10.8, and versions 4.0.0 through 5.10.0 contain a resource management error vulnerability. This vulnerability stems from Ods::processTableRow in...

Traefik Labs Traefik authorization issue vulnerability

Traefik Labs Traefik versions prior to 3.7.0 and 3.7.14 contain an authorization issue vulnerability. This vulnerability arises because the Kubernetes Ingress-NGINX provider forwards client-supplied Ssl-Client- headers to plaintext HTTP routers. When ssl-redirect is disabled and...

Javo Spot path traversal vulnerability

Versions of Javo Spot prior to 3.0.0 contain a path traversal vulnerability. This vulnerability stems from a path traversal issue in the fn parameter of the jvfrmspotgetjson AJAX operation. Unauthenticated attackers can read arbitrary files, potentially obtaining database credentials and keys...

Silicon Labs Z-Wave SDK authorization issue vulnerability

Silicon Labs Z-Wave SDK versions 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices contain an authorization issue vulnerability. This vulnerability stems from a lack of validation in the ZWAVECMDNODESEXIST handler, potentially allowing devices already on...

Ricardo Olsen {json:scada} SQL injection vulnerability

Ricardo Olsen json:scada Versions prior to 0.65-alpha contain an SQL injection vulnerability. This vulnerability stems from improper handling of the HistoryReadRequest parameter NodeId.Id, StartTime, and EndTime within the opcApi function in src/serverrealtimeauth/index.js. Authenticated users ca...

hwk-fr ACF Extended cross-site scripting vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

Drupal Webform code injection vulnerability

Drupal Webform versions prior to 6.2.12 and from 6.3.0 up to but including 6.3.1 contain a code injection vulnerability. This vulnerability stems from improper handling of special elements by the template engine, potentially leading to code injection...

Drupal Combined image style resource management error vulnerability

In Drupal, there is a resource management error vulnerability in versions 0.0.0 through 1.0.7. This vulnerability arises from the lack of restrictions or throttling on resource allocation, potentially leading to excessive resource consumption...

Silicon Labs EmberZNet buffer error vulnerability

Silicon Labs EmberZNet versions 9.1.1 and earlier contain a buffer error vulnerability. This vulnerability arises from an out-of-bounds write when processing malformed GetGroupMembership messages, potentially leading to a crash...

Drupal Webform authorization issue vulnerability

Versions of Drupal Webform prior to 6.2.12 and from 6.3.0 up to but including 6.3.1 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks and may lead to forced browsing...

OrbiTeam BSCW Server path traversal vulnerability

Versions 5.x prior to OrbiTeam BSCW Server 5.2.5 and versions 7.x prior to 7.4.4 contain a path traversal vulnerability. This vulnerability stems from the use of the stylename parameter in theme operations, allowing unauthenticated attackers to send GET requests containing ../ sequences to...

Pascal Buchbinder mod_qos buffer error vulnerability

Versions 11.74, 11.76, and 11.79 of Pascal Buchbinder’s modqos contain a buffer error vulnerability. This vulnerability arises when processing percent-encoded inputs during JSON body filtering; improper termination of strings can lead to reading beyond allocated memory boundaries. As a result,...

Drupal Diba carousel slider cross-site scripting vulnerability

Drupal Diba carousel slider versions prior to 0.0.0 and 3.0.2 contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

Amazon AWS SAM CLI command injection vulnerability

Versions of Amazon AWS SAM CLI prior to 1.166.2 contain a command injection vulnerability. This vulnerability stems from OS command injection within Terraform hooks; attackers can influence the Terraform configuration or plan files used during builds. By using specially crafted Terraform resource...

GitLab authorization issue vulnerability

Versions prior to GitLab EE 19.3.6—specifically 19.2, 19.4 prior to 19.4.3, and 19.5 prior to 19.5.1—are affected by an authorization issue vulnerability. This vulnerability stems from insufficient granularity in administrator lockout controls; it may allow authenticated users with group Owner...

Drupal Webform permission and access control issues vulnerability

Versions 0.0.0 through 6.2.12 and versions 6.3.0 through 6.3.1 of Drupal Webform contain a permission and access control vulnerability. This vulnerability stems from the use of unsafe operations in permission definitions, potentially leading to stored cross-site scripting attacks...

WordPress SureDash authorization issue vulnerability

WordPress SureDash versions 1.12.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

Better-Auth authorization issue vulnerability

Versions 1.4.0-beta.18 through 1.7.7 of better-auth contain an authorization vulnerability. This vulnerability arises when Magic Link is enabled and storeToken is set to plain, or when storeToken is set to hashed while global verification.storeIdentifier is also set to hashed; additionally, if th...

Drupal amazee.ai Private AI Provider SQL injection vulnerability

Drupal amazee.ai Private AI Provider versions prior to 0.0.0 and 1.3.7, as well as versions prior to 1.4.0 and 1.4.3, contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

CrawlSEO encryption issue vulnerability

Versions of crawlseo prior to 0.2.5 contain an encryption vulnerability. This vulnerability arises because Google OAuth access tokens and refresh tokens are stored unencrypted in the User.googleTokens column. Attackers with database read permissions can read these plaintext long-lived refresh...

GitLab authorization issue vulnerability

GitLab EE versions prior to 12.0 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an authorization issue vulnerability. This vulnerability arises because, after enabling instance-level SAML or LDAP member locking, the system fails to fully enforce the member locking restrictio...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcubewashtml fails to validate the by attribute in SVG SMIL animations; as a result, tags within HTML emails can load remote...

WordPress Paid Member Subscriptions authorization issue vulnerability

WordPress Paid Member Subscriptions versions 3.1.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

Marcos Penelas Cámara Next.js Ecommerce Template authorization issue vulnerability

The Marcos Penelas Cámara Next.js Ecommerce Template contains an authorization bypass vulnerability. This vulnerability arises from unauthorized access to user-controlled keys; shopping cart and wishlist operations rely solely on primary key matching without verifying the associated user...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises because the billable metric propertyname and category filter values are rendered directly into Jinja-generated queries for counting, dashboards, and rate metrics without proper escaping. As a resul...

Drupal Webform authorization issue vulnerability

Versions prior to Drupal Webform 6.2.12 and 6.3.1 contain an authorization issue vulnerability stemming from improper authorization checks, which may lead to server-side request forgery...

Vercel Next.js resource management error vulnerability

Versions 13.0.0 through 15.5.28 and 16.0.0 through 16.4.1 of Vercel Next.js contain a resource management error vulnerability. This vulnerability arises from specially crafted requests directed at App Router applications that include at least one Server Action; it may lead to excessive CPU...

Roundcube Webmail Project Roundcube Webmail Cross-site Request Forgery vulnerability

The Roundcube Webmail project contains a cross-site request forgery vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises from CSRF validation bypass in the markasjunk plugin’s mark-as-junk functionality. The plugin reads the UID parameter from POST data...

Zenorzz Goploy authorization issue vulnerability

Zenorzz Goploy versions 4.0.0-beta.1 and earlier contain an authorization issue vulnerability. This vulnerability arises from authorization bypass via user-controlled keys, which can be exploited due to improperly configured access control security levels...