CVE Vulnerability Catalog

In Manyfold versions 0.96.0 through 0.140.0, authenticated users can rename uploaded files using path traversal sequences. The file app/models/model_file.rb uses user-controlled filenames in File.join(model.path, filename) without proper sanitization, allowing files to be moved or written outside the configured library directory.

A potential insecure permissions vulnerability was found in Legion Zone and Lenovo App Store Windows applications, distributed exclusively in the Chinese market. If installed on a non-system partition, a local user could execute arbitrary code.

An SSRF vulnerability in stoatchat before 0.14.0 allows unauthenticated attackers to bypass DNS-based IP blocklists. The url_is_blacklisted function only inspects the first resolved address, while the HTTP client iterates all cached addresses.

In text-generation-inference up to version 3.3.7, a server-side request forgery (SSRF) vulnerability exists in the OpenAI-compatible multimodal chat completions endpoint. An unauthenticated network attacker can force the server to issue arbitrary HTTP GET requests by supplying a crafted image_url value in chat message content.

A vulnerability in Axelor Open Platform versions 8.x prior to 8.2.2 allows authenticated non-admin users to escalate privileges by bypassing field restrictions during nested relational save operations. Attackers can modify sensitive User record fields such as roles and groups by submitting changes through a related entity's save path, leading to admin role assignment.

A vulnerability in zrok (versions 0.4.23 through 2.0.3) allows an attacker to write files outside the selected local destination root via attacker-controlled WebDAV or zrok drive paths like /../outside.txt. The issue is fixed in version 2.0.3.

In HAPI FHIR before version 6.9.7, the FHIRPathEngine passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service (DoS).

The @tmlmobilidade/utils library in the Gestor de Oferta application has a prototype pollution vulnerability in the setValueAtPath() function. The issue is due to unsafe path segments not being blocked, which can lead to object prototype modification.

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below is vulnerable to PowerShell command injection when establishing remote PowerShell sessions. This flaw allows an attacker to execute arbitrary PowerShell commands on the WAC Gateway.

A vulnerability in the XML::Bare library for Perl (versions up to 0.53) causes an infinite loop when parsing malformed XML attributes. The parserc_parse function fails to advance the attribute-parse state cursor for certain malformed forms, leading to a hang.

A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) causes an infinite loop when parsing malformed HTML attributes. The parserc_parse function fails to advance the attribute-parse state cursor on certain malformed forms, leading to a hang.

A vulnerability in Lenovo App Store, distributed exclusively in the Chinese market, could allow a local authenticated user to execute arbitrary code with elevated privileges.

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market. This flaw could allow a local authenticated user to execute arbitrary code.

Kiota before versions 1.29.1 and 1.32.5 resolved OpenAPI $ref values by fetching remote URLs and reading local file paths, allowing SSRF, remote file inclusion, and local file inclusion during client generation.

In SimpleChat prior to version 0.241.206, several plugin validation routes lacked enforcement of authentication and authorization at runtime. Routes such as POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin_name>, POST /api/admin/plugins/repair/<plugin_name>, and POST /api/plugins/validate were documented as requiring security but did not check if the user was logged in or had proper permissions. This allowed unauthenticated or unauthorized clients to invoke plugin validation, health check, and repair operations.

In Prompty prior to version 2.0.0-beta.2, the loaders expanded ${file:...} references in .prompty frontmatter without validating that resolved paths stayed within the allowed directory, allowing an attacker-controlled prompt file to read local files via absolute paths, .. traversal, or symlink escapes.

A vulnerability in the Prompty library allows arbitrary JavaScript execution when loading .prompty files. The TypeScript loader uses gray-matter without overriding default frontmatter engines, enabling an attacker to inject malicious code via a file with ---js frontmatter.

A vulnerability in LogicalDOC Enterprise up to version 9.1.1 allows an authenticated attacker to perform blind SQL injection in the ComparisonServlet component. Crafted input can be used to manipulate SQL queries.

Kiota before versions 1.29.1 and 1.32.5 honored a poisoned workspace.json configuration without validating output paths, allowing generated files to be written outside the workspace root on a developer or CI host.