Kavita path traversal vulnerability

Versions Kavita 0.5.2 through 0.5.4.1 contain a path traversal vulnerability. This vulnerability arises because the filename parameter allows path traversal; unauthenticated attackers can send GET requests containing ../ sequences to /api/image/cover-upload to read any file outside the temporary...

Silicon Labs Connect SDK authorization issue vulnerability

Silicon Labs Connect SDK versions 4.3.1 and earlier, as well as Flex SDK versions 3.7.7 and earlier, contain an authorization issue vulnerability. This vulnerability arises because messages containing invalid security settings can bypass authentication, potentially leading to network disruptions...

NewType Infortech NT OneAPP encryption issue vulnerability

NewType Infortech NT OneAPP versions 1.5.22 and earlier contain an encryption vulnerability. This vulnerability allows unauthenticated local attackers who obtain ADB backup access and confirm the backup process to extract plaintext usernames and passwords from the backup data, resulting in...

Drupal Webform authorization issue vulnerability

Versions of Drupal Webform prior to 6.2.12 and from 6.3.0 up to but including 6.3.1 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks and may lead to forced browsing...

Drupal SAML SSO – Service Provider side channel information disclosure vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain a side-channel information disclosure vulnerability. This vulnerability stems from an observable time difference that may lead to brute-force attacks...

Bytecode Alliance wasmtime post-link vulnerability

Versions of Wasmtime prior to 24.0.13, from 25.0.0 up to versions prior to 36.0.14, from 37.0.0 up to versions prior to 46.0.3, and from 47.0.0 up to versions prior to 47.0.4 contain a post-link vulnerability. This vulnerability arises because cap-std’s dependency fails to properly handle symboli...

OpenBao authorization issue vulnerability

Versions prior to OpenBao 2.6.3 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks; attackers can exploit it by omitting the X-Vault-Header and sending requests to /agent/v1/quit or /proxy/v1/quit via server-side request forgery. This may...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because the AppRole authentication method fails to verify whether a Secret ID has expired; as a result, expired Secret IDs remain valid until they are periodicall...

LXC Incus authorization issue vulnerability

Versions prior to LXC Incus 6.0.7, from 6.1.0 up to versions prior to 7.0.2, and from 7.1.0 up to versions prior to 7.5.0 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks on GET /1.0/operations/uuid. It may allow clients with restricted...

LXC Incus authorization issue vulnerability

Versions LXC Incus prior to 6.0.5 through 6.0.7, 6.12.0 prior to 7.0.2, and 7.1.0 prior to 7.5.0 contain an authorization issue vulnerability. This vulnerability arises because restricted project users can use cluster refresh requests to perform pull mode migrations. Attackers with instance...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because, when renewing tokens issued by the Kubernetes Auth method, it fails to verify whether the originally used service account token remains valid. As a resul...

MongoDB C# Driver input validation error vulnerability

A vulnerability related to input validation exists in MongoDB C Driver versions 2.0.0 through 3.13.0. This vulnerability stems from improper logic within the data query component of update statement construction, causing application-provided values to be interpreted as queries or updates rather...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR contains an authorization issue vulnerability. This vulnerability arises because the untrusted bundle body can replace partition identities previously established by a trusted source; by default, storage partition permissions are not enforced. As a result, attackers...

OpenBao log information leakage vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a log information leakage vulnerability. This occurs when request audit logs are successfully recorded but response audit logs fail to be recorded; as a result, no response audit entries are written for unauthenticated...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR has an authorization issue vulnerability. This vulnerability stems from improper authorization checks during conditional creation operations. Users lacking both CREATE and READ permissions can submit conditional creation requests that match existing resources via...

Hsiaoming Yang mistune resource management error vulnerability

Hsiaoming Yang’s Mistune contains a resource management error vulnerability. This vulnerability stems from an inefficient algorithm complexity issue in the parselinktext function. Remote attackers can exploit it by submitting markdown containing numerous mismatched brackets, triggering repeated...

MongoDB C# Driver processing logic error vulnerability

Versions 1.8.0 through 3.13.0 of the MongoDB C Driver contain a logic error vulnerability. This vulnerability arises because when writing additional members to GeoJSON, there is no check to see whether the member names conflict with reserved GeoJSON members such as type and coordinates. As a...

Hsiaoming Yang mistune resource management error vulnerability

In version 3.0.0 prior to Hsiaoming Yang Mistune 3.3.0, there is a resource management error vulnerability. This vulnerability stems from an algorithm complexity flaw in the parselinktext function of the inline link parser. When an attacker submits Markdown containing a large number of unbalanced...

Apache Abdera input validation error vulnerability

All versions of Apache Abdera contain an input validation error vulnerability. This vulnerability stems from improper restrictions on XML external entity references. When the application uses Abdera to parse XML controlled by attackers, it may allow attackers to access sensitive data or initiate...

Hsiaoming Yang mistune resource management error vulnerability

Versions 3.0.0 through 3.3.0 of Hsiaoming Yang Mistune contain a resource management error vulnerability. This vulnerability stems from an algorithm complexity issue in the parselinktext function within src/mistune/helpers.py when handling deeply nested square brackets. Attackers can submit...

MongoDB C# Driver numeric error vulnerability

A numeric error vulnerability exists in MongoDB C Driver versions 2.0.0 through 3.13.0. This vulnerability stems from a flaw in the BSON processing library regarding numerical type conversion. Untrusted text inputs containing boundary values for binary subtype types can bypass integrity checks on...

OpenBao information disclosure vulnerability

Versions 2.2.0 prior to OpenBao 2.6.4 and 2.7.0 prior to 2.7.1 contain an information disclosure vulnerability. This vulnerability arises from the exposure of the tlsacmeeabmackey value via the sys/config/state/sanitized endpoint. It may allow attackers to obtain the MAC key used for binding ACME...

OpenBao authorization issue vulnerability

In OpenBao versions prior to 2.6.2, version 2.5.0 contains an authorization issue vulnerability. This vulnerability arises because when usecsrsans is enabled, no PKI role allowedipsanscidr restriction is enforced on IP SAN values derived from the CSR. As a result, authenticated callers possessing...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

MongoDB C# Driver input validation error vulnerability

A vulnerability related to input validation exists in MongoDB C Driver versions 2.14.0 through 3.13.0. It arises due to the failure to escape dot and dollar signs when processing dictionary keys, field names, and array filter identifiers within LINQ queries. This may result in applications...

oretnom23 php-travel-agency-system input validation error vulnerability

The oretnom23 php-travel-agency-system contains a security vulnerability stemming from improper handling of parameters costomerid/paymenttype/amount/description/user/uploadimage/fullname/visano in the admin/insert.php file, which may lead to SQL injection...

LXC Incus permission and access control issue vulnerability

Versions prior to LXC Incus 7.0.2—specifically 7.0.1 and versions prior to 7.5.0 but including 7.2.0—are affected by a permission and access control vulnerability stemming from authorization bypass. Restricted clients can exploit this by omitting “source.type” in their POST requests directed at...

LXC Incus encryption issue vulnerability

Versions LXC Incus prior to 7.0.0 and 7.1.0 up to 7.5.0 contain an encryption vulnerability stemming from a flaw in the signature validation of the built-in S3 server. This flaw allows pre-signed URL holders to inject unsigned x-amz- headers, potentially enabling them to copy objects from other...

Raskus Prospero Flow CRM authorization issue vulnerability

Versions of Roskus Prospero Flow CRM from 2.0.0 up to and including 5.26.0 contain an authorization issue vulnerability. This stems from a lack of authorization checks in the user API. The GET /api/user/id and DELETE /api/user/id routes in routes/api.php utilize only the auth:api middleware...

Bytecode Alliance wasmtime resource management error vulnerability

The Bytecode Alliance WasmTime versions prior to 46.0.0 and 47.0.0 are affected by a resource management error vulnerability. This vulnerability stems from uncontrolled resource allocation issues in the WASIp3 implementation; without any limits on buffer size, malicious clients can provide large...

MongoDB C# Driver processing logic error vulnerability

Versions 1.8.0 through 3.13.0 of the MongoDB C Driver contain a logic error vulnerability. This vulnerability arises because, when determining whether two clients can share a cache connection, only the issuer and serial number are compared for TLS client certificates. As a result, an attacker who...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR has an authorization issue vulnerability stemming from improper access control. When REST-hook subscriptions are enabled, users with subscription creation privileges may query and read resources they are otherwise denied access to, resulting in unauthorized access...

Roundcube Webmail Project Roundcube Webmail authorization issue vulnerability

The Roundcube Webmail project contains an authorization issue vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because the check only compares the action name of a request without parsing any deprecated aliases. Remote authenticated attackers can...

Canonical Juju Juju authorization issue vulnerability

Versions 4.0 through 4.15 of Canonical Juju contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization in the unit resources download routing. Subjects authenticated by the controller—either unit agents or users with login privileges only—can specify any...

OpenVPN 3 Core Library encryption issue vulnerability

Versions 3.4 through 3.11.7 of the OpenVPN 3 Core Library contain an encryption vulnerability stemming from improper certificate validation. This vulnerability may allow attackers to bypass restrictions on the use of extended keys...

CrawlSEO server-side request forgery vulnerability

Versions prior to 0.2.4 of crawlseo contain a server-side request forgery vulnerability. This vulnerability arises because the isPrivateIp function within its crawler engine fails to block IP address ranges, and unverified addresses are not fixed for actual outbound connections. As a result,...

Drupal Webform cross-site scripting vulnerability

Drupal Webform versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation, potentially enabling cross-site scripting attacks...

WordPress Contact Form Email Cross-site Scripting Vulnerability

WordPress Contact Form Email versions 1.3.68 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web form generation and may lead to stored cross-site scripting attacks...

Drupal Cloud encryption issue vulnerability

Drupal Cloud versions 0.0.0 through 7.0.1 contain an encryption vulnerability stemming from improper certificate validation, which may lead to man-in-the-middle attacks...

Drupal SAML SSO – Service Provider cross-site scripting vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain a cross-site scripting vulnerability. This flaw stems from improper input handling during web page generation and may lead to cross-site scripting attacks...

Goose information disclosure vulnerability

Goose has a vulnerability related to information disclosure. This vulnerability arises because when the integration feature for Goose terminals is enabled, it captures shell command history and sends it word-by-word to a configured LLM provider endpoint without any sanitization. When users input...

KNIME Business Hub SaaS information disclosure vulnerability

Versions prior to KNIME Business Hub SaaS 1.19.0 contain an information disclosure vulnerability stemming from improper authorization. This vulnerability may allow unauthorized remote users to obtain basic account information...

ABB Ability Edgenius authorization issue vulnerability

ABB Ability Edgenius versions 3.2.3.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing unauthorized access to these functions...

Georg Sieber Open Computer Orchestration Cross-site Scripting Vulnerability

Versions of Georg Sieber Open Computer Orchestration prior to 1.2.1 contain a cross-site scripting vulnerability. This vulnerability arises because Html::commandButton embeds action URLs containing stored computer hostnames into JavaScript strings within its inline onclick handler; only HTML...

Roundcube Webmail Project Roundcube Webmail permission and access control issues vulnerability

The Roundcube Webmail project contains a permission and access control vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from CSS scope bypass in HTML messages. The rcubeutils::modcssstyles function fails to treat the “at-rule” prefix as a selector...

Amazon AWS SAM CLI command injection vulnerability

Versions of Amazon AWS SAM CLI prior to 1.166.2 contain a command injection vulnerability. This vulnerability stems from OS command injection within Terraform hooks; attackers can influence the Terraform configuration or plan files used during builds. By using specially crafted Terraform resource...

Ricardo Olsen {json:scada} SQL injection vulnerability

Ricardo Olsen json:scada Versions prior to 0.65-alpha contain an SQL injection vulnerability. This vulnerability stems from improper handling of the HistoryReadRequest parameter NodeId.Id, StartTime, and EndTime within the opcApi function in src/serverrealtimeauth/index.js. Authenticated users ca...

Drupal Combined image style resource management error vulnerability

In Drupal, there is a resource management error vulnerability in versions 0.0.0 through 1.0.7. This vulnerability arises from the lack of restrictions or throttling on resource allocation, potentially leading to excessive resource consumption...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail::extractinlineimages fails to validate the media type within inline image data URIs. Remote authenticated attacke...

PHPOffice PhpSpreadsheet resource management error vulnerability

Versions prior to PHPOffice PhpSpreadsheet 1.30.7, versions 2.0.0 through 2.1.19, versions 2.2.0 through 2.4.8, versions 3.3.0 through 3.10.8, and versions 4.0.0 through 5.10.0 contain a resource management error vulnerability. This vulnerability stems from Ods::processTableRow in...