CVE Vulnerability Catalog

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

A vulnerability was found in bitcoinj up to 0.17 in the url.openConnection function of PaymentSession.java within the Payment Request Handler component. Manipulating the pki_type argument can lead to server-side request forgery, exploitable remotely, and the exploit has been publicly disclosed.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected.

The Apache Airflow SFTP provider's deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) disable SSH host-key verification by default unless the connection explicitly sets no_host_key_check to false. Deployments that run SFTP sensors or operators in deferrable mode are affected.

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections relying on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture credentials or data.

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments enabling multi-team mode with the Keycloak auth manager are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson IDs to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user IDs. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.