CVE Vulnerability Catalog

In nimiq/core-rs-albatross (a Rust implementation of the Nimiq Proof-of-Stake protocol) prior to version 1.3.0, the handshake handler accepts a peer-supplied limit of 0 and stores it unchanged. In the HandshakeAck path, limit 0 returns zero contacts, appearing benign. Later, in the Established state, computing self.peer_list_limit.unwrap() as usize - 1 with limit 0 wraps to usize::MAX, causing a panic when attempting memory allocation.

A vulnerability in Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations.

OpenPrinting CUPS versions 2.4.16 and earlier contain a vulnerability that allows a local unprivileged user to coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable `Authorization: Local ...` token. This token enables /admin/ requests on localhost, and the attacker can create a persistent printer queue with a file:///... URI despite the FileDevice policy. Printing to that queue allows arbitrary root file overwrite, potentially leading to privilege escalation.

OpenPrinting CUPS versions 2.4.16 and prior have a vulnerability in a network-exposed cupsd with a shared PostScript queue. An unauthenticated client can send a print job, and the server processes a page-border value with an embedded newline, allowing execution of an arbitrary binary (e.g., /usr/bin/vim) as user lp.

OAuthenticator before version 17.4.0 has an authentication bypass vulnerability. An attacker with an unverified email address on an Auth0 tenant can log in to JupyterHub, and if email is used as the username, they can take over accounts.

RAGFlow versions up to 0.24.0 contain a Server-Side Template Injection (SSTI) vulnerability in the TextProcessing and Message components. It allows an authenticated user to execute arbitrary OS commands on the server via unsafe Jinja2 template rendering.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the Activity List API endpoint. An authenticated administrator can extract sensitive data from the database, including user credentials, email addresses, and all stored content.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the pwg.users.getList API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands.

In Piwigo prior to version 16.3.0, the pwg.history.search API method is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors.

A vulnerability in Hirschmann HiLCOS Classic Platform switches exposes user passwords synchronized with SNMPv1/v2 community strings transmitted in plaintext. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access.

Hirschmann HiLCOS devices (OpenBAT, WLC, BAT300, BAT54) before version 8.80 and OpenBAT before 9.10 are shipped with identical default SSH and SSL keys that cannot be changed. This allows unauthenticated remote attackers to decrypt or intercept encrypted management communications.

The Amazon Athena ODBC driver before version 2.0.5.1 on Linux contains an OS command injection vulnerability in the browser-based authentication component. An attacker can use specially crafted connection parameters loaded by the driver during a local user-initiated connection to execute arbitrary code.

The Amazon Athena ODBC driver before version 2.1.0.0 lacks resource limits during parsing. Crafted input can cause excessive resource consumption and denial of service (DoS).

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows.

The Amazon Athena ODBC driver before version 2.1.0.0 improperly validates certificates when connecting to external identity providers, allowing a man-in-the-middle attacker to intercept credentials. This does not affect connections to Athena.

The Amazon Athena ODBC driver before version 2.1.0.0 improperly neutralizes special elements in authentication components. An attacker can use crafted connection parameters to execute arbitrary code or redirect authentication flows.

A specific administrative endpoint is accessible without proper authentication, exposing device management functions. Lack of access control allows unauthorized users to access sensitive operations.

prompts.chat prior to commit 1464475 contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

prompts.chat prior to commit 30a8f04 has a server-side request forgery (SSRF) vulnerability in the Fal.ai media status polling feature. Authenticated users can perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter, leading to disclosure of the FAL_API_KEY in the Authorization header.

In prompts.chat prior to commit 7b81836, missing isPrivate checks across API endpoints and page metadata generation allow unauthorized users to access sensitive data associated with private prompts, including version history, change requests, examples, current content, and metadata (titles, descriptions).