CVE Vulnerability Catalog

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (getMediaFromRemoteUrl()). A user with Media permission can create a playlist with source=remote_url and remote_type=playlist pointing to a file:// path or internal HTTP endpoint. When AutoDJ builds the queue, the backend passes the URL directly to file_get_contents() with no scheme allowlist or private/loopback IP policy, allowing disclosure of host files (e.g., /etc/passwd or .env) and bodies of internal HTTP requests. No patched version was available at the time of publication.

AzuraCast before 0.23.8 contains an SSRF vulnerability in webhook URL validation. The validation only rejects link-local IP addresses, not loopback or private ranges, and non-IP hostnames bypass the check entirely. A user with WebHooks permission can configure a webhook to internal resources and trigger an HTTP POST with Now Playing data.

AzuraCast before 0.23.8 contains an SSRF vulnerability in Remote Relay URL validation. The validation only checks URL syntax and scheme, with no host or IP restrictions. A user with RemoteRelays permission can set a URL to loopback, private network, or cloud metadata addresses, and the automatic Now Playing sync will send requests to those addresses.

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder parameter in AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions to extract sensitive database information, including user credentials and station settings.

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source or content. If an application invokes algo_from_pickle on an attacker-supplied pickle file, an object defining __reduce__ is executed during deserialization, resulting in arbitrary code execution.

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payloads that execute arbitrary code when loaded through MONAI's standard data pipeline.

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component. User-controlled values from the YAML configuration file and CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True. If a victim loads a crafted configuration file, arbitrary commands are executed with the privileges of the user running the job.

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.

MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions built solely from constants and attribute, subscript, or call nodes contain no ast.Name nodes and bypass the allowlist. An attacker who can influence a bundle's metadata can escape the eval sandbox and achieve code execution.

In MONAI 1.6.0, PersistentDataset explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors to run torch.load(hashfile, weights_only=False). Related cache helpers also call pickle.loads on cached content and use hashlib.md5 for cache keys. A local user with write access to a shared cache directory can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context.

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malicious bundle with crafted configuration containing arbitrary code that executes when a victim loads the bundle using monai.bundle.load() or monai.bundle.run().

In Contrast versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). A malicious host can supply an ACPI table with arbitrary AML bytecode that the guest kernel interpreter executes with access to all guest memory, including private pages. This affects AMD SEV-SNP platforms (Metal-QEMU-SNP and Metal-QEMU-SNP-GPU); Metal-QEMU-TDX is not affected.

In Contrast versions before 1.19.1, Kata agent policies generated by the Contrast CLI contained a flaw in CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could overwrite security-critical files or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover.

Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DNS label boundary, so a registry entry such as [registries."ghcr.io."] is also applied to any host whose name merely ends in that byte sequence, including attacker-registered domains such as evilghcr.io. When an image or layer is pulled from such a sibling domain, the imagepuller sends the configured Authorization header (basic auth, registry token, or identity token), trusts the configured custom CA bundle, follows the configured mirror, and honours insecure-skip-verify (disabling TLS verification) for that host.

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any correctly verified TEE attestation report with the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker able to intercept network traffic and forge reports can impersonate a Contrast Coordinator or workload, defeating identity verification in aTLS.

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update introduced an 'allow_storage' rule that accepts storage entries using the 'image_guest_pull' driver without verifying the image digest. An attacker with access to the Kata agent API can substitute a container image with an exploit payload if it satisfies the remaining policy rules.

A vulnerability in the Edimax BR-6428nC router version 1.16 affects an unknown function in the file /goform/formWizSurvey of the Wireless Wizard Handler component. Manipulation of the interface1/interface2 arguments leads to a stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.

A flaw has been found in coollabsio Coolify up to 4.1.2 in an unknown function of app/Http/Middleware/CanUpdateResource.php in the Route-Level Middleware component. Manipulation can lead to missing authorization, and the attack can be launched remotely. The exploit has been published and may be used.