CVE Vulnerability Catalog

A vulnerability was found in Frappe HR up to 16.15.0, affecting the get_expense_claims/get_shift_requests/get_attendance_requests functions in hrms/api/__init__.py (Permission Validation component). Manipulation of the employee argument leads to incorrect authorization. The attack can be launched remotely; the vendor confirmed the issue has already been fixed.

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely, and the exploit is now public.

Joomla Extension regularlabs.com Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 is vulnerable to privileged stored XSS via data-rlta-url attributes. The plugin accepts a url option for an item and writes it to a generated data-rlta-url attribute, which the browser code passes to window.open() when the item is activated. Affected versions do not reject browser URL schemes that execute JavaScript.

Joomla Extension regularlabs.com Modules Anywhere versions 1.5.0 - 9.0.5 for Joomla is vulnerable to LFI / SSRF. Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter; Joomla's core Feed module opens the rssurl parameter server-side and accepts local file: URLs as well as network URLs.

A security vulnerability was detected in notionnext-org NotionNext up to 4.10.10, affecting the cleanCache function in pages/api/cache.js (Authentication Guard component). Manipulation of the token argument leads to missing authentication. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check; in versions 4.9.5.7 - 4.10.10 a guard exists but is only enforced when CACHE_REVALIDATION_TOKEN is set, so default deployments remain unprotected. The vendor did not respond to the disclosure.

A weakness was identified in Cesanta Mongoose up to 7.21, affecting the fn function in tutorials/mqtt/mqtt-server/main.c (MQTT Broker component). Manipulation leads to a stack-based buffer overflow. The attack can be launched remotely and the exploit is publicly available. Upgrading to version 7.22 (patch a9df523f76f43a38bd53b4232b9cfd4c16869e71) addresses the issue.

A security flaw was discovered in Netcore NBR200V2 version 1.3.241127.071246. Manipulation of the url argument in the system function of /usr/bin/network_tools within the Tools Ping Handler component results in OS command injection. The attack can be initiated remotely and the exploit has been publicly released.

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24.

Vulnerability in Netcore NBR200V2 1.3.241127.071246 in the eval function of /www/cgi-bin/network_tools in the web management interface. Manipulation of the QUERY_STRING argument leads to OS command injection. Remote attack possible, exploit publicly available.

Vulnerability in Netcore NBR100V2 1.3.240614.030928 in the uci.apply function of /usr/share/rpcd/acl.d/unauthenticated.json in the ACL Handler component. Manipulation of the section argument leads to missing authorization. Remote attack possible, exploit publicly disclosed.

Vulnerability in OctoberCMS up to versions 4.1.19/4.2.25/4.3.4 in the getSourcePathForResize function of modules/system/classes/ResizeImages.php. Manipulation of the realSourcePath argument leads to server-side request forgery (SSRF). Remote attack possible, exploit public. Upgrading to 4.3.5 or 4.4.0 resolves the issue.

Vulnerability in Eyeplus 57.0.0.0308 in an unknown function of the p2pcam HTTP Parser component. Manipulation leads to stack-based buffer overflow. Remote attack possible, exploit publicly disclosed.

In Eyeplus 57.0.0.0308, an unknown function in the file /snapshot of the p2pcam Service leads to information disclosure. The attack can be performed remotely. The exploit has been published and may be used.

In Eyeplus 57.0.0.0308, the GetUsers function in the /onvif/Device file of the ONVIF component leads to information disclosure. The attack can be executed remotely. The exploit is now public and may be used.

A cross-site scripting (XSS) vulnerability was found in mini-inventory-and-sales-management-system in the Items.php file. Manipulating the itemName argument allows remote attack. The exploit is publicly available.

In GEOritm up to version 2.45.1, manipulation of the objectId argument in the /restapi/objects/obj-groups file of the REST API component leads to missing authentication. The attack can be launched remotely. The exploit is publicly available. Upgrading to version 2.46 mitigates the issue.

A vulnerability in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007 affects an unknown functionality of the file /wallpaper in the Wallpaper Upload component. Manipulation of the wallpaper argument causes improper validation of syntactic correctness of input. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Vulnerability in athlon1600 youtube-downloader up to version 4.0.1 in the stream function of public/stream.php. Manipulation of the url argument leads to server-side request forgery (SSRF). Remote attack possible, exploit public. Commit 6ffe823 does not restrict destination host.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the updateJiraProjects function in the /jira-import file of the Jira Import component leads to server-side request forgery via manipulation of host/username/token arguments. The attack can be initiated remotely. The exploit has been disclosed to the public.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack may be performed remotely. The exploit has been published.