CVE Vulnerability Catalog

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access or permission to create/modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment processing the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.

Code Injection vulnerability in Logsign SIEM by Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Allows execution of arbitrary code. The issue affects versions from 6.4.101 before 6.4.117.

Path Traversal vulnerability in Logsign SIEM by Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Allows access to files outside the allowed directory. The issue affects versions from 6.4.101 before 6.4.117.

A vulnerability in Logsign SIEM allows an attacker to use default or common usernames and passwords. The issue affects versions from 6.4.101 before 6.4.117.

A vulnerability in Canonical LXD (versions 4.0 and later, fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) allows an authenticated client or a malicious migration source server to write attacker-controlled files to arbitrary paths on the host as root, leading to full host compromise. The attack uses a crafted rsync or btrfs send stream that plants a symlink in the transferred volume.

Improper link resolution in the recursive file pull feature of the LXD CLI client in versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10, and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

SQL injection vulnerability in enVision software by Iron Mountain Archiving Services Inc. Allows manipulation of SQL queries. The issue affects versions before 260655.

Missing authorization in imageDownload in Canonical LXD before versions 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

A path traversal vulnerability in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root. The attack uses a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

A path traversal vulnerability in the btrfs storage driver in Canonical LXD (versions 4.0.2 and later, fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) allows an authenticated client with permission to create instances to delete arbitrary files on the host as root. On hosts with btrfs root filesystem, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise.

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can send a GET request with the file path parameter set to any path, including an absolute local file path. This issue was fixed in version V4.

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

Dayforce ESS Excelity is vulnerable to Time-Based Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare a GET request with one of the parameters filled in with an arbitrary SQL query, which is interpreted as part of an SQL predicate. This issue was fixed in version V3.

Path Traversal vulnerability in ABB Protection and control IED manager (PCM600) through version 2.14. Allows an attacker to access files outside the intended directory.

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600) through version 2.14. May allow an attacker to gain unauthorized access to resources.

A vulnerability was identified in Netcore NR289-GE 1.4.5102 in the system function of the file /ap_ip.cgi of the CGI Handler component. Manipulation of the argument ip leads to OS command injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814, affecting unknown code of the file /exchange/attachment/upload in the Upload Endpoint component. Manipulation of the File argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.

A security vulnerability has been detected in dbgate up to 7.3.1, affecting the function files in packages/api/src/controllers/runners.js of the Files Endpoint component. Manipulation of the runid argument leads to path traversal. The attack is possible remotely and the exploit has been publicly disclosed.