CVE Vulnerability Catalog

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. It affects unknown code of the file /callrec/userAddAction.do of the component User Management. Manipulation of the argument Username leads to LDAP injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted but did not respond.

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. It affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted but did not respond.

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs no object-level authorization check on user_id = 1. A Secondary Administrator (user_type = 1, user_id != 1) can rewrite the Primary Administrator's user_type to 2 (Guest / read-only), destroying the root account's privilege and locking the legitimate owner out of the instance. At time of publication, there are no publicly available patches.

InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments, in version 1.7.2 has a vulnerability allowing takeover of the primary administrator account. A previous fix (PR #1638) protected the direct password change but not the user_email attribute. A secondary administrator can edit the primary administrator's account and change their email address, then use the public password recovery flow to receive a reset token and take over user_id=1.

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the literal substring onload appears in the URL value (/^data:.*onload/i). Because data: payloads are routinely Base64-encoded, the dangerous content is invisible to that substring test. A URL such as data:text/html;base64,… therefore survives in href / xlink:href, even though the decoded payload is active markup. This is an incomplete input-validation / sanitization defect. Patched in version 1.0.15.

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim's account to inherit the victim's role, including proxy_admin privileges, and permanently overwrite the victim's stored identity binding to retain persistent unauthorized access to administrative endpoints exposing API keys and user management.

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to and including 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the nonce guard is gated behind an isset() check and fails open, no capability check is performed, and sanitize_text_field() does not strip shortcode delimiters, allowing an attacker to inject a second attacker-controlled [smile_modal] invocation. This allows authenticated attackers with Subscriber-level access to inject a PHP object, but impact is limited unless a POP chain is present via another plugin or theme.

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09.

In @grpc/grpc-js prior to versions 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. This causes sensitive information disclosure when the message contains sensitive data.

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. Fixed in versions 1.13.1 and 1.14.1.

A vulnerability was found in Eleveo Quality Management 9.7.0. It affects some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted but did not respond.

A vulnerability has been found in Eleveo Quality Management 9.7.0. It affects an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.

A flaw was found in Eleveo Call Recording Software 9.7.0 in an unknown function of the file /callrec/audio.jsp in the Play Audio Page component. Manipulating the viewRoleId/cfType arguments leads to cross-site scripting, and the attack can be launched remotely. The exploit has been published and may be used; the vendor did not respond.

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can cause the IPNET subsystem to fail to properly release allocated kernel memory and file descriptors before terminating the calling application. Fixed in Version 26.09.

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.